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Technical Assessment Report 

1.0 Notification and Authorization 

The November 15, 1967, loss of X-15 Flight 3-65-97 (hereafter referred to as Flight 3-65) was a 
unique incident in that it was the first and only aerospace flight accident involving loss of crew 
on a vehicle with an adaptive flight control system (AFCS). In addition. Flight 3-65 remains the 
only incidence of a single-pilot departure from controlled flight of a manned entry vehicle in a 
hypersonic flight regime. Both the advent of small, commercially developed entry vehicles and a 
renewed interest in the use of adaptive control to improve performance and flight safety have 
necessitated a thorough analysis of the causal and contributing factors in this accident. 

To mitigate risk to emerging aerospace systems, the NASA Engineering and Safety Center 
(NESC) proposed a comprehensive review of this accident. The goal of the assessment was to 
resolve lingering questions regarding the failure modes of the aircraft systems (including the 
AECS) and thoroughly analyze the interactions among the human agents and autonomous 
systems that contributed to the loss of the pilot and aircraft. 

Mr. Cornelius J. Dennehy, NASA Technical Eellow for Guidance, Navigation, and Control 
(GN&C) was selected as the NESC lead, with Dr. Jeb S. Orr assigned as the technical lead. 

The key stakeholders for this assessment were Mr. Garry Lyles, Space Launch System (SLS) 
Program Chief Engineer; Mr. Kurt Jackson, SLS Program Integrated Avionics and Software 
Discipline Lead Engineer; Mr. Mark West, SLS Vehicle Management Discipline Lead Engineer; 
the Human Exploration and Operations Mission Directorate; and the Commercial Crew Program. 
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4.0 Executive Summary 

The X-15 program operated three hypersonie, high-altitude roeket-propelled single-pilot aircraft 
from 1959 until 1968. The third aircraft, X-15-3, was involved in a fatal accident on November 
15, 1967. X-15-3 was the most advanced aircraft flown during the program and carried a variety 
of sophisticated instrumentation and electronics, including the MH-96 adaptive flight control 
system (AFCS). 

The X-15-3 aircraft was destroyed during atmospheric entry after entering uncontrolled flight at 
an altitude of 230,000 feet and a velocity near Mach 5. The pilot. United States Air Force 
(USAF) Major Michael J. Adams, was incapacitated by the aircraft accelerations and was killed 
either during the ensuing breakup or upon ground impact. 

To better understand the risks to emerging aerospace systems incorporating advanced 
technologies such as adaptive flight control, the NASA Engineering and Safety Center (NESC) 
organized a comprehensive assessment of this fatal accident in light of almost 50 years of 
accumulated experience in flight operations, human factors, and flight control. The report of the 
1968 NASA/United States Air Force Accident Investigation Board (AIB) was used as a point of 
departure for the present assessment. The goal of the study was to characterize the causes of the 
loss of life, as well as to determine, at a level of detail not addressed in the original report, the 
exact role of the MH-96 AFCS in the accident. 

The NESC assessment confirmed that the root cause of the accident was an electrical disturbance 
originating from an experiment package using a commercial-off-the-shelf (COTS) component 
that had not been properly qualified for the X-15 flight environment. Notably, the risks of 
accelerated and/or limited flight qualification of COTS components have been highlighted in 
other recent assessments by the NESC. These assessments are referenced in the final report. 

The performance of the pilot was found to be commensurate with his experience and 
qualifications. As noted by the 1968 AIB, spatial disorientation (SD) may have contributed to 
pilot workload. However, the NESC assessment found no conclusive evidence to support the 
hypothesis that SD was a causal factor. On the contrary, the evidence suggests that poor design 
of the pilot-aircraft interface and ineffective operational procedures prevented the pilot and 
ground control from recognizing and isolating the numerous failures before the aircraft’s 
departure from controlled flight was inevitable. 

The MH-96 AECS limit cycle oscillation (ECO) that contributed to the breakup of the aircraft 
was analyzed in detail by the NESC team. Using nonlinear simulation and frequency-domain 
analytical methods, the NESC analysis determined that the ECO was caused by a design 
oversight in a control system notch filter that was installed only on the X-15-3 aircraft. This 
notch filter was used to stabilize an unstable structural resonance but introduced a latent failure 
mode that only appeared in severe off-nominal conditions. The notch filter design issue was not 
identified in the 1968 AIB report. The MH-96 failure mode was shown to be independent of the 
adaptive control law. This key NESC finding highlights the fact that the implementation of the 
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adaptive control hardware, not the underlying theory of adaptive flight control, was the 
contributing factor in the loss of X- 15 -3. 

Finally, the NESC assessment highlighted several programmatic and cultural themes 
contributing to the accident, including continued flight operations in the presence of multiple 
unexplained anomalies and an insufficient focus on the risks of subsystem-level interactions. 

This NESC final report documents a total of 10 findings and 18 recommendations, which are 
directed to the key stakeholders for this assessment. 
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5.0 Introduction 

The X-15 research aircraft (Figure 5.0-1) is widely regarded as one of the most successful 
high-performance flight research platforms ever developed. Although it encountered numerous 
technical and programmatic challenges over the course of its development, the X-15 eventually 
became a test bed for validating numerous concepts that were fundamental enabling technologies 
for other programs, including the Apollo program and the Space Transportation System. During 
the X-15’s operational lifetime, the breaking of new records of speed and altitude for manned 
flight became almost routine, and the program continued successfully in spite of several severe, 
nonfatal accidents. Many advances in the modern understanding of hypersonic flight mechanics, 
including thermal protection, structural design, shock-impingement heating, air-data sensing, and 
hypersonic propulsion can be directly attributed to research performed using the X-15 platform. 
Many research pilots and astronauts contributed substantially to the success of the program 
during its 199 flights and nearly 10-year operational history [ref. 4]. 



Figure 5. 0-1. X-15 56-6672 in Fiight (USAF photo) 


Owing to its diverse mission capabilities and the relative immaturity of autonomy in aerospace 
engineering at the time, the X-15 from its inception was designed to be a piloted aircraft. Only 
later in the design process did nontraditional approaches to guidance, navigation, and control 
(GN&C) begin to enter the design space. These approaches were, in all respects, conservative 
and motivated primarily by functionality and engineering practicality. These included, most 
notably, an AFCS that eased pilot workload by automatically adjusting the gains of the aircraft’s 
aerodynamic control surfaces in response to changing flight conditions. This experimental flight 
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control system, designated the MH-96 AFCS, experienced a relatively sueeessful deployment on 
X-15-3 (serial number 56-6672) [refs. 5 and 6]. 

In addition, the X-15-3 was considered a test bed for development of advanced GN&C 
teehnologies, and along with the advaneed flight control system, ineluded an advanced inertial 
system, a boost guidance and energy management computer, and advanced pilot displays. The 
other two aircraft (X-15-1 and X-15-2) used a eonventional, pilot-selectable fixed-gain stability 
augmentation system (SAS) and eonventional instruments. Erratic behavior of the AFCS during 
Flight 3-65 was a key faetor in the subject accident and will be diseussed in detail in the coming 
sections. 

In the course of its operation at the NASA Flight Research Center' (FRC), all three X-15 aircraft 
underwent numerous field modifieations, upgrades, and equipment retrofits. This praetiee of 
adapting the aircraft capabilities to meet mission needs was a key enabler in the X-15’s agility as 
a seience platform. However, this plaeed a substantial demand on the pilot-engineers that 
managed the X-15 during its highly dynamie missions. 

5.1 Accident Summary 

On November 15, 1967, X-15-3 was destroyed in flight due to a structural load exceedance 
precipitated by a loss of eontrol [ref 3]. The researeh pilot, USAF Major Michael J. Adams, did 
not survive the event. The flight (denoted 3-65-97) was the 65th flight of X-15-3 and the 
191st flight of the X-15 program. 

The eauses of the accident are complex, beginning with an electrical anomaly associated with an 
experiment motor that had not been properly qualified for the space environment. This electrical 
anomaly led to a series of electrical and instrumentation failures that required continuous 
attention from the pilot to diagnose and troubleshoot. Ground eontrollers, laeking adequate 
aireraft information displays and believing the pilot would effeetively manage the emergency, 
did not inform the pilot of the multiple subsystem anomalies or recommend that the mission be 
diseontinued. 

In the already high-demand environment of the ballistie hypersonie flight regime, the excessive 
workload contributed to the pilot’s apparent loss of spatial and instrument mode awareness. The 
pilot, apparently mostly unaware of the eondition of the aireraft systems, provided control inputs 
that allowed the aircraft to enter a hypersonie spin that evolved into an inverted dive. The dive 
may have been recoverable, but a persistent high-amplitude flight control system ECO 
originating in the MH-96 AECS prevented the pilot from regaining eontrol of the aircraft. The 
ECO also contributed to the airframe load exeeedances that eventually caused the aircraft to 
break up at approximately 60,000 feet. 


' Later Dryden Flight Research Center (DFRC), and now Armstrong Flight Research Center (AFRC). 
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5.2 Motivation 

A concern has recently arisen within the aerospaee community as to the implieations of the 
X-15-3 accident for the design of emerging manned hypersonic vehicles, launeh vehieles, and 
spaeeeraft. For example, the renewed interest in boost-glide eoneepts for transportation and 
suborbital spaee tourism neeessitates the use of ballistie trajeetories that are not unlike those 
experieneed by the X-15 [ref. 5]. In addition, orbital spaee planes whose nominal entry 
trajeetories differ substantially from the X-15’s often eneounter conditions similar to an 
X-15 entry in the event of a powered abort. While avionies, sensing, and autonomy teehnologies 
have advaneed by orders of magnitude in the last 50 years, the fundamental challenges 
assoeiated with hypersonie ballistic flight remain largely unchanged. Insofar as it relates to the 
ability of a flight crew to suceessfully manage a space plane through the highly dynamic phases 
of boost, suborbital eoast, entry, and glide, the lessons learned from the X-15-3 aeeident lend 
insight as to potential requirements for flight eontrol design, vehiele instrumentation, erew 
spatial/situational awareness, and abort modes. These lessons are relevant and applieable even if 
vehiele manual or semi-manual control is implemented only as a baekup to a fully automatie 
guidanee and eontrol system. 

In addition, in recent years some aspeets of the anomalies experienced on Flight 3-65 have been 
ineorreetly reported in the literature, probably owing to the limited availability of the flight test 
data and failure report outside the NASA eommunity [refs. 7 and 8]. No eomprehensive aeeount 
of the aeeident exists in the open literature that treats the issue at a system level and diseusses the 
human factors, flight controls, and other subsystem anomalies simultaneously. The present 
report attempts to bridge the gap in the aeeident understanding by examining in detail the 
relevant systems (i.e., instrumentation and flight eontrol) and the programmatie and eultural 
faetors that led to this fatal accident. 

5.3 Sources 

Several exeellent referenees exist regarding X-15 program history, design, engineering, 
operation, and subsystems. Many of the teehnical data are in original program doeuments and 
teehnieal reports with several available in the open literature; these are refereneed where 
appropriate. The most eomplete historieal aeeounts are those of Jenkins [refs. 4 and 9]. These 
works provide a eomprehensive look at the evolution of the program and the aireraft, with many 
first-hand accounts by participants in the X-15’s design and operation. 

The January 1968 report of the joint NASA/USAF Aeeident Investigation Board (AIB) 

[ref. 3] that reviewed the eauses of the destruction of the X-15-3 is a primary source for the 
present discussion. This report is extensive, and while it eontains teehnieal data in the attaehed 
appendiees, some of the referenees therein are unfortunately lost. For various reasons, 
referenee 3 is not available outside the NASA eommunity as of the time of this writing. While 
the NASAAJSAF AIB report eontains the most comprehensive assessment of the aeeident 
available, it is limited in depth and self-eontradietory in some respeets. Importantly, the report 
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lacks detail, especially with respect to the AFCS function. After an extensive search, many 
important references were identified that provide additional insight into the operation of various 
aircraft subsystems. 

Much of the critical design data on the X-15 has been lost. This issue is complicated by the fact 
that much of the design and engineering work was performed across disparate organizations. 
While the X-15 program as a whole was effective at documenting research results [ref. 10], 
design data were rarely consolidated and maintained for future use. In the event design data 
were consolidated, their self-consistency is often questionable since the vehicle configurations 
varied widely over the program’s 10-year lifespan [ref 4]. Various surviving documents related 
to the flight control system are dispersed among NASA, the Department of Defense (the USAF 
and the United States Navy (USN)), and contractor archive libraries, owing to the diverse 
heritage of the AFCS as an incrementally developed technology with its origins in the USAF 
research organizations. 

A careful and concerted effort has been undertaken to assemble a picture of the aircraft and 
systems configuration at the time of the accident. Given the substantial changes in the vehicle 
design that occurred during its development and operation, as well as the lack of a single source 
that details its final configuration, it is surprisingly easy to draw erroneous conclusions about the 
operational vehicle’s characteristics from the data available in the open literature. The authors 
have attempted to construct a cohesive and self-consistent description of the X-15-3 aircraft as 
flown in November 1967 through careful checking and cross-referencing of numerous reports 
and technical data. 

It is important to note that the formal assessment of the appropriateness or correctness of the 
original AIB recommendations is not within the seope of the present study. While some findings 
and recommendations of this study both supplement and extend, and in some cases, contradict, 
the findings of the AIB report, the present study was conducted considering all of the available 
objective evidence, with more than 45 years of human factors, flight control, and flight test 
operations experience aeeumulated since the end of the X-15 program. 

Finally, it is with full cognizance that the present report appears at a time when residual “tribal 
knowledge” associated with the X-15 program is sparse. The number of living persons having 
direct engineering development and test experience with the X-15 program is likely less than a 
few dozen. This is a solemn reminder that current and future aerospace vehicle development 
programs must include a strong emphasis on retaining a documentation tree focused on 
requirements and speeifications, and on the corresponding design motivation, underlying 
reasoning, and innovations. 

5.4 Report Structure 

The structure of this report is as follows. In Section 6, a systems-level overview of the 

X-15 aireraft and its mission profile is provided. Various aspects of the pilot instrumentation and 

flight control system are discussed to aid in understanding the phenomena that were present at 
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the time of the accident. In Section 7, a timeline of Flight 3-65 is provided with detailed 
information as to the aircraft state throughout the trajectory based on an analysis of the available 
flight data. 

Section 8 provides a detailed look at the fundamental subsystem failure modes that contributed to 
the accident. In Section 9, the human factors, programmatic, and engineering culture aspects of 
the accident are discussed. Summary conclusions and the NASA Engineering and Safety Center 
(NESC) recommendations are presented in Section 10. Finally, a comprehensive simulation 
analysis was conducted in an effort to better characterize and understand the conditions under 
which the MH-96 AFCS could exhibit behavior commensurate with that which contributed to the 
accident. While the results are summarized in Section 8, a detailed description of the modeling 
methodology appears in Appendix A. Supplementary information, including detailed plots of 
reconstructed flight data, appears in Appendix B. 

6.0 The X-15 Research Aircraft 

The X-15 was a piloted, single-seat rocket-propelled hypersonic research aircraft developed 
under cooperative funding and program management from the USAF, the USN, and NASA. 
Initial design concept engineering was completed in the early 1950s, and a prime contract for 
three aircraft was awarded to North American Aviation in September 1955. The first of three 
airframes was completed in October of 1958. The charter of the X-15 program was primarily to 
provide a platform for high-speed aerothermodynamic and high-altitude aeromedical research, 
and the design approach followed a capability-driven model anchored to specific performance 
targets expressed in terms of speed, altitude, and flight duration. Military interest in the X-15 
development by the USAF and the USN stemmed from the applications of manned hypersonic 
systems for reconnaissance and strategic weapon delivery. The ill-fated X-20 Dyna-Soar skip- 
entry bomber program, being developed in parallel to the X-15, was to have adopted numerous 
technologies from the X-15 had it not been cancelled in late 1963. In fact, several mature 
technologies from the canceled X-20 (e.g., a version of the inertial navigation system) were used 
on the X-15 [ref. 1 1]. 

6.1 Design Overview 

The X-15 aircraft was a reusable winged space plane with a launch mass of about 33,000 Ibm, 
depending on the particular airframe and equipment loadout [ref 4]. By 1967, all X-15s were 
powered by a single, regeneratively cooled YLR99-RM-1 throttleable rocket engine providing a 
thrust at altitude of 57,000 Ibf with a specific impulse of 265 seconds and a total burn time 
capability of 180 seconds [ref. 12]. The X-15 structure was comprised primarily of Inconel® X, 
a high-strength nickel-steel alloy that was capable of withstanding the high aerothermal loading 
and peak temperatures of approximately 1,300 degrees Fahrenheit in the stagnation regions 
[ref 10]. The airframe volume was occupied by integral pressure-stabilized propellant and 
oxidizer tanks containing anhydrous ammonia and liquid oxygen, with ullage and purge 
pressures maintained via an integral helium supply. Eiquid nitrogen was stored for cooling and 
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cabin pressurization, and a hydrogen peroxide supply provided propellant for the two auxiliary 
power units (APUs) used to supply electrical power and run the hydraulic systems. A separate 
hydrogen peroxide supply was used for the ballistic control system (BCS) monopropellant 
thrusters in the nose, now commonly referred to as a reaction control system (RCS). A third 
hydrogen peroxide supply in the aft compartment, cross-strapped to the RCS and APU tanks, 
was used to provide power to the YLR-99 turbopumps that supplied propellants to the main 
propulsion system [ref 13]. 

An internal layout drawing of the X-15 is shown in Figure 6.1-1. The X-15 cockpit consisted of 
a single seat aft of the RCS compartment and forward of the equipment bay. The cockpit used a 
canopy having two planar windows, and pilots reported that despite the small windscreen the 
outside view during approach and landing was acceptable [ref 14]. 
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tank (fuel) 


Liquid oxygen 
tank (oxidizer) 

Liquid nitrogen 


Auxiliary 
power units 


Attitude 


Hydrogen 

peroxide 


Hydrogen 

peroxide 
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0G0051 


Figure 6.1-1. X-15 Research Aircraft Internai Layout (NASA ) 

Aft of the pilot station was an equipment bay containing most of the research instrumentation. 
Each X-15 airframe was extensively instrumented, and a large portion of the research and flight 
instrumentation data (about 90 distinct measurements) was telemetered to the ground. The 
remainder was recorded onboard using a combination of film oscillographs and tape recorders. 
Each aircraft was instrumented with approximately 1,000 aerodynamic and aerothermal 
transducers, thermocouples, and pressure taps [ref 15]. 

6.2 Trajectory 

The X-15 was carried to a launch altitude of 45,000 feet by a NASA NB-52 carrier aircraft on a 
launch pylon below the starboard wing, and nominally flew a ballistic or depressed high-altitude 
trajectory with a launch point 200 to 300 nautical miles uprange of the landing site. Trajectories 
were generally flown along an azimuth southwest from the launch point along a fixed magnetic 
heading toward the landing site. Most X-15 flights lasted about 10 minutes from carrier aircraft 
launch to touchdown [ref 4]. 
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The X-15 mission profiles and target flight eonditions varied substantially based on speeifie 
research objectives but were generally classified into the two major categories of altitude and 
speed profiles. Altitude profdes, such as the design reference mission shown in Figure 6.2-1, 
consisted of a ballistic atmospheric exit to an altitude exceeding 200,000 feet after experiencing 
an engine burn of 80-100 seconds and a peak axial acceleration nearing 4 g. 

The X-15 altitude trajectory consisted of an immediate engine ignition and throttle up after 
separation from the NB-52 carrier aircraft, followed by a 2- to 2.5-g pull-up to maintain a 
prescribed angle of attack (a) or pitch attitude, typically around 12 or 32 degrees, respectively. 
The aircraft velocity during the propulsive phase increased from Mach 0.7 at launch to 
approximately Mach 5. The aircraft was stabilized after atmospheric exit using the RCS system 
throughout the trajectory, with the aircraft experiencing about two minutes of 0-g before a rapid 
onset of dynamic pressure associated with atmospheric reentry. The aircraft was stabilized at a 
predetermined entry a and decelerated at a nominal normal load of 5 g before being recovered 
into an equilibrium glide at a high supersonic Mach number. Energy management procedures 
were then executed to null entry dispersions and preparation for a landing on 
Rogers Dry Lake, California [ref 10]. 


DESIGN ALTITUDE MISSION 



Figure 6.2-1. X-15 Altitude Design Reference Mission (NASA) 

6.3 Flight History 

The X-15 program conducted 199 research flights over a period of nearly 10 years. The first 
unpowered drop test was conducted on June 8, 1959, and the final powered flight was completed 
October 24, 1968. During this period, the program routinely set altitude and speed records for 
a piloted aerospace plane and ultimately held the record for the highest altitude (354,200 feet; 
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August 22, 1963) and highest Mach number (Mach 6.7; October 3, 1967). These official records 
persisted until the orbital reentry of Space Shuttle STS-1 in April 1981. 

The X-15 program was not without frequent anomalies and several serious accidents. This era of 
flight research was characterized by a fast pace of system and mission development, quick 
advancement of envelope expansion, and relatively poor hardware reliability compared with 
currently acceptable standards for safety-critical components. Aborts due to subsystem 
malfunctions were commonplace, but safety precautions were a regular facet of mission planning 
(e.g., trajectories were designed such that abort-to-landing capability was available with 
sufficient energy at all points in the mission profile). While the acceptance of risk during flight 
test operations was a common feature of the X-15 program, numerous test and checkout 
procedures were employed prior to flight, and go/no-go criteria were established for critical 
subsystems. However, owing to the short flight duration, the generally poor radio 
communications between the flight controllers and the X-15 pilots, and a high reliance on the 
research pilot to troubleshoot subsystem issues, the pilot’s role in mitigating the effects of 
component failures was paramount. In nearly all cases where major subsystem anomalies 
threatened the safety of flight, direct action by the pilot successfully prevented a catastrophic 
accident [ref. 4]. 

The X-15 program suffered four major accidents, three of which were in-flight with only one 
occurring at a high altitude and Mach number. In the only major ground accident, a propulsion 
system malfunction caused an explosion in the X-15-3 airframe during ground operations in June 
1960 but caused no major injuries. 

In November of 1959, the first serious landing accident resulted in a structural failure on 
X-15-2 when it landed heavy after an abort. The pilot sustained no major injuries. In the second 
nonfatal flight incident in November of 1962, the pilot made an emergency landing in the same 
airframe. The aircraft again landed heavy and the wing flaps failed to deploy, causing a collapse 
of the left main landing skid upon touchdown. The vehicle tumbled, and the pilot was seriously 
injured, but recovered after several weeks [ref. 10]. The only fatal accident of the program, the 
subject of the present report, occurred in November 1967. 

6.4 Instrumentation 

Instrumentation aboard the aircraft, excluding supplemental research instrumentation, was used 
to measure the aircraft dynamic states for the purposes of flight control and pilot display. All 
three X-15 aircraft were similar in terms of instrumentation subsystems. Flight instrumentation 
onboard the X-15-3 aircraft available to the AFCS and the pilot included an inertial measurement 
unit (IMU), a dual-redundant rate gyro package, an aerodynamic flow direction sensor, and flight 
control accelerometers. 
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6,4,1 Stable Platform and Inertial Flight Data System (IFDS) 

The stable platform was a three-axis IMU contained in the forward equipment bay. In the initial 
design, the stable platform was a Sperry FRC-66 3-axis IMU coupled to an analog navigation 
computer. Together, the sensor package and its navigation hardware were referred to as the 
IFDS (inertial flight data system). In 1964-65, the FRC-66 package on X-15-1 and X-15-3 was 
replaced with the digital X-20 IFDS, which provided better computational accuracy at the 
expense of degraded gyro drift and higher mass [ref 11]. 

As a gimbaled platform, the attitude solution was available directly from the IMU gimbal 
resolvers. The attitude director indicator (ADI) “ball,” the pilot’s primary attitude instrument, 
was slaved directly to the IMU output [ref .11]. The ADI could be operated in a gross attitude 
mode or one of two selectable precision indicator modes. One of the precision modes, called 
precision attitude indicator (PAI), used horizontal and vertical needles on the display to indicate 
fine pitch and roll error in place of the usual a and sideslip {P) error. 

The stable platform was a four-gimbal system designed to avoid attitude singularities 
(“gimbal lock”). IMU data were available for use in attitude (roll, pitch, and heading) hold 
modes, which were provided by the MH-96 AFCS [ref 16]. At low dynamic pressure of less 
than 50 psf, the IFDS could provide a based on velocity and attitude for use in the MH-96 
a hold mode in place of the measured a from the flow direction sensor [ref. 2]. 

The IFDS was used to derive inertial estimates of altitude, altitude rate, and velocity magnitude. 
Experience showed that the inertial estimates of the velocity and altitude were acceptably 
accurate for about 300 seconds of flight [ref 17] but were expected to drift following entry and 
thus were seldom relied upon for ranging decisions [refs. 11, 18, and 19].^ While the IFDS was 
the primary source of pilot information during the boost trajectory phase, it was not considered 
mission critical for two reasons. First, flight planning relied on reaching a particular burnout 
velocity, and with engine performance relatively well characterized, pilots flew to a specified 
bum time (or burned all propellant available) rather than attempting to meet a velocity constraint 
[ref. 18]. Secondly, the availability of more accurate radar velocity data communicated from 
ground control supplanted the use of inertially derived measurements. 

In progress at the time of the Flight 3-65 incident was the development of a boost and entry 
guidance capability by Ames Research Center, related to work that had been performed in 
support of the canceled X-20 program [refs. 20 and 21]. This supplemental guidance computer 
(AN/AYK-5), referred to as ALERT, was installed on X-15-3 with an advanced instmment panel 
having vertical tape displays versus the conventional instmments [ref 4]. The ALERT system 
was installed on X-15-3 at the time of the accident, and its boost-guidance mode was used for 
pitch steering cues during the power-on phase [ref 3]. 


^ Based on flight data, the digital IFDS exhibited a l-o altitude error of approximately 5,000 feet at 500 seeonds 
[ref. 11]. 
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6.4.2 Rate Gyros 

While the stable platform contained a triad of rate gyros used in maintaining the platform 
orientation, a separate set of body-fixed (“strapdown”) gyros were used for flight control rate 
damping [ref. 16]. The flight control rate gyros were located in the aft equipment bay, and were 
packaged into two identical three-axis assemblies to support the MH-96 AFCS’s dual-channel 
redundant configuration. The other X-15 airframes had only one gyro package. One notable 
feature of the flight control rate gyro was its failure monitor circuit, which was intended to 
mitigate failure effects that could be manifested as a full-scale output. In the event that the gyro 
output rate exceeded 22.5 degrees/second, the failure monitor was tripped and the input from the 
gyro to the flight control system was zeroed. Reset was automatic upon reduction of rate below 
the critical threshold. No indication of this behavior was provided to the pilot [ref 3]. 

6.4.3 Flow Direction Sensor 

The innovative X-15 “ball nose” air data system, or Q-ball, was a hypersonic flow direction 
sensor mounted in the aircraft nose [ref. 22]. Using a servo feedback loop on an articulated 
spherical differential pressure sensor, accurate estimates of a and at high Mach number could 
be provided to the pilot to a dynamic pressure of approximately 50 psf Below 50 psf, estimates 
of a and P were generally accurate except during RCS pulses from the nose jets [ref 23]. Usable 
measurements were available to a dynamic pressure as low as 3.5 psf ^ The flow-field 
interaction near the nose corrupted the measurements, but the effect was transient and pilots were 
aware of the phenomenon (Figure 6.4-1). However, the transient behavior precluded the use of 
measured data for a-hold at low dynamic pressure. A calibrated measurement of dynamic 
pressure was provided by the ball nose and was considered accurate within 2 percent above 
Mach 2.5 [ref. 17]. 


^ The 3-65 flight plan called for the pilot to establish and hold a at 7 psf 
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FILM TIME REFER -NCE (SECONDS) 

Figure 6.4-1. RCS Jet Flow-Held Interaction with Fiow Direction Sensor at 3 psf, 

240,000 feet, Mach = 4.4 [ref. 1] 

6,4,4 Accelerometers 

Separate from the IFDS IMU was an accelerometer package collocated with the AFCS hardware 
in the forward equipment bay. While lateral acceleration feedback was used to augment 
directional stability in the early design, it was removed with yaw rate to roll feedback by late 
1963 to be consistent with the deletion of the ventral fin [ref. 19]. Normal acceleration 
measurements were used primarily in the pitch control loop and to provide a normal load 
limiting function in the MH-96. This limiting function provided nose-down feedback as the 
normal acceleration approached 5.5 g [refs. 1 and 2]. The pilot’s display of normal acceleration 
was provided by a separate, self-contained accelerometer mounted in the instrument panel 
[ref 17]. 

6.5 Flight Control System 

The X-15 flight control system configuration differed based upon the airframe. On all three 
vehicles, aerodynamic control surfaces consisted of a vertical stabilizer with an all-moving 
rudder surface and an all-moving horizontal tail with differential actuation for roll control 
[ref. 24]. Three-axis attitude control during exoatmospheric flight was provided by dual string of 
RCS monopropellant peroxide jets in the nose and wingtips [ref. 25]. Wing trailing surfaces 
included landing flaps that were deployed on final approach but were unused during powered, 
ballistic, or entry flight. Aft speed brakes were available for energy management after engine 
shutdown. The jettisonable lower ventral fin was used to increase lateral-directional stability 
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above Mach 6, but after determining that aircraft stability characteristics were improved during 
high-altitude reentries without the fin, it was removed from the X-15-3 after 1963 [ref 26]. 

Aerosurface motion control (Figure 6.5-1) was provided by a set of power-boost hydraulic 
actuators supplied by a dual-redundant hydraulic system. The interface to the hydraulic 
servocylinders was mechanical and was interlinked to the pilot inceptors via a set of pushrods 
and cables with spring bungees and nonlinear gearing for artificial feel [ref 24]. 




X-15-1 andX-15-2 (serial numbers 56-6670 and 56-6671) used a pilot-selectable “fixed-gain” 
three-axis SAS with rate gyro feedback having a range of ten preset gains in each axis available 
for pilot selection during flight [ref. 24]. The fixed-gain system design was consistent with 
systems conventionally deployed on research aircraft at the time, and as such, pilots were 
familiar with the process of adjusting SAS gains during flight to maintain acceptable handling 
qualities. Until the ventral fin removal in 1963, the SAS was required for entry from most flight 
conditions due to an unstable lateral-directional (“dutch roll”) mode exhibited by the X-15 at 
high Mach numbers and moderate a [ref 26]. The SAS stabilized the unstable airframe in this 
flight regime to allow the pilot to safely complete the entry. Exoatmospheric stabilization was 
provided by manual inputs on the left-hand controller, or a rate-damping reaction augmentation 
system (RAS). The RAS used one-half (one string) of the reaction control authority in each axis 
[ref. 27] to damp body rates during the ballistic coast. 
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X-15-3 used a substantially more advanced experimental flight control system, the MH-96 
[ref. 28]. The MH-96 was referred to as a “self-adaptive” flight control system. The MH-96 
AFCS provided better reliability and fail-safety than the basic SAS through the use of a 
dual-redundant architecture with extensive internal failure monitoring. A principal function of 
the MH-96 was to enable automatic blending of the reaction controls and aerosurfaces during the 
atmospheric exit and entry transition phases. For this reason, X-15-3 was preferred for extended 
high-altitude trajectories due to the improvement in controllability, decreased pilot workload, 
and reduced RCS propellant expenditures [ref. 5]. 

The MH-96 aerodynamic control function was based upon a sophisticated adaptive approach that 
maintained a small-amplitude limit cycle in the aerodynamic control surface servoactuators via 
the modulation of the forward gain in the inner loop (Figure 6.5-2). In essence, the system was 
designed to bring the gain of the aerodynamic control to its maximum permissible value at all 
times, thus operating the system at its upper stability limit. Since the servoactuator limit cycle 
frequency was approximately invariant with respect to flight condition, the MH-96 gain changer 
electronics were able to maintain a nearly constant aircraft dynamic response over the entire 
flight envelope as the dynamic pressure and control surface effectiveness changed. Since these 
parameters were highly uncertain and not believed to be reliably measurable with the air data 
system, the adaptive approach provided an effective method of decreasing sensitivities to the 
time-varying aircraft parameter variations (Figure 6.5-3). 



Figure 6.5-2. MH-96 Adaptive Concept 
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Figure 6.5-3. MM- 9 6 Typical Gain Variation [ref. 2] 

The MH-96 designers recognized that since the adaptive gain was inversely proportional to the 
control surface effectiveness, the adaptive gain could be used to determine the necessity of 
supplemental reaction control. To that effect, the MH-96 incorporated an attitude-rate RCS 
phase plane controller"^ with an “R/C AUTO” mode that automatically engaged and disengaged 
the RCS based upon the value of the sum of the adaptive gains in all three axes. RCS was 
enabled when the adaptive gains reached 90 percent of their maximum sum, and RCS was 
disengaged at 75 percent of the maximum sum^ [ref 29]. RCS control with the MH-96 was 
provided through the right-hand control inceptor used for aerodynamic surfaces, such that the 
pilot was not required to transition to the left stick during atmospheric exit. Manual RCS 
engage/disengage for the MH-96 and the left-hand inceptor was provided in addition to the 
“R/C AUTO” mode, but manual control was seldom needed during high-altitude flights with the 
MH-96. 


The MH-96 RCS actuators were solenoid valves, providing on-off control authority in contrast to the proportional 
control authority available on the left hand manual controller. The designers of the left-hand controller implemented 
proportional control when exoatmospheric piloting technique was in its infancy, and it was later recognized that 
pilots exclusively used the left-hand control in an on-off pulsed mode. 

^ The reported values vary. These are taken from the contractor final report in the post acceptance-test configuration 
[ref 29], 
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Detection of the desired limit cycle to adjust the gain relied upon a filtering operation, or 
frequency-domain discrimination (the MH-96 gain modulation element was configured to 
respond to changes only in a narrow portion of the frequency spectrum of the sensed control 
signal, which was taken at the output of the servocylinder). The assumption was that only the 
limit cycle activity would be present in this narrow frequency range and, thus, would be isolated 
from other signals below (i.e., rigid-body control motions) or above (i.e., structural flexibility) 
this band. A more extensive discussion of the MH-96 AFCS design and operation appears in 
Appendix A. 

6.6 Emergency Egress System 

Cockpit egress was enabled by a rocket-propelled ejection seat that was developed specifically in 
support of the X-15 aircraft. The seat was a necessarily complicated, but functional design that 
included a deployable stabilization system to ensure the seat would not tumble after separation 
from the aircraft. The canopy was jettisoned during the ejection sequence using a separate 
pyrotechnic system, or it could be actuated manually. 

The ejection seat was certified for operation to approximately Mach 4 and 120,000 feet altitude. 
While it was qualified to a limited extent using rocket sled tests, it was never demonstrated in 
conditions of high Mach number or high dynamic pressure. In the event of a high-altitude or 
high-Mach malfunction, pilots planned to stay with the aircraft as long as possible or until 
flight conditions allowed ejection [ref 4]. The ejection system was never used during the 
X-15 program, although the canopy jettison mechanism was actuated by the pilot during the 
November 1962 landing accident. 

6.7 Pilot Interface 

The X-15 cockpit layout was relatively conventional for aircraft of the era, with the exception of 
having three control inceptors and vertical-tape displays for several instruments. Panel changes 
were frequent throughout the program. Panel modifications were incorporated, to some extent, 
into the simulator using interchangeable modules such that simulated missions could be flown 
using a panel similar to that in the aircraft [ref. 4]. While the X-15-3 originally had a cockpit 
layout nearly identical to the other two aircraft, an updated panel was installed in the fall of 
1965, primarily to include instrumentation for the experimental boost and entry guidance 
systems (see Figures 6.7-1 and 6.7-2) [ref 4]. 
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Figure 6.7-1. X-15-3 Original Panel (1960-1965) 



Figure 6. 7-2. X-15-3 Vertical Tape Panel (1965+) 
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6.7.1 Control Inceptors 

A conventional center stick directly actuated the control surface servocylinders and was 
mechanically connected to a right-hand side stick controller. The right-hand controller provided 
hydraulieally boosted inputs to the center stiek, such that the center stick tracked the side stick 
and vice-versa. The side stick was intended for high-G operation. In addition, the RCS manual 
control inceptor was positioned on the pilot’s left side. This meehanical stick was directly 
connected to metering valves that drove the RCS jets. 

In normal operation with the MH-96, the right-hand stick was used to provide rate commands to 
the autopilot. The left-hand stick, as a mechanical override, was not used without first disabling 
the automatie system [ref. 2]. The autopilot was responsible for responding to the rate 
commands using an automatically blended combination of the aerosurfaces and the RCS jets. 

The left-hand manual controller drove both RCS jet strings in parallel, while the automatic 
system commanded only a single string. In this arrangement, the pilot had double the control 
authority of the automatic system, such that commands issued by the automatic system could be 
foree-overridden by the pilot. This was not without consequenee, in that opposing a rate 
damping command from the automatic system would expend three times the RCS propellant per 
unit time while the automatic and manual jets fired simultaneously. 

6.7.2 Flight Instruments 

The primary instruments available to the pilot for dedueing the aircraft state included the ADI 
“ball,” a set of attitude deviation needles with selectable reference, a p indicator, a selectable 
heading/roll rate indicator, and a set of navigated state outputs (e.g., altitude, altitude rate, and 
velocity). Dynamic pressure and normal acceleration were displayed primarily for use during 
the entry and pullout maneuver. 

The instrument configuration and operation and the pilot interface was primarily driven by 
engineering need and functionality, and lacked a formal approaeh to human-machine integration. 
This is evidenced by the exceptionally eomplicated proeedures associated with subsystem status, 
enable, disable, and reset functionality. Several instruments had multiple modes, one of which 
was of critical importance during the accident. 

A summary of the instrumentation that was intended to be functional and presented to the pilot 
on Flight 3-65 is summarized in Table 6.7-1. An attempt has been made to detail each 
instrument’s functional status during Flight 3-65. 
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Table 6. 7-1. Sources of Aircraft Dynamic State Information A vallable to Pilot, 
Flight 3-65 Configuration 


Display 

Data 

Source 

Limitations 

Malfunctioned? 

ADI 

Aircraft inertial roll, 
pitch, and heading 
{(f), e, y/) 

IFDS IMU 

None applicable 

No 

Attitude 
indicator 
deviation needle 
(vertical) 

P or roll error {(j)e), 
depending on PAI 
mode 

Ball nose flow 
direction sensor or 
IFDS computer 
(depending on 
computed aip 
mode); IFDS IMU 
(in PAI mode) 

aip from ball 
nose inaccurate 
due to RCS jet 
interaction below 
50 psf 

Yes 

Attitude 
indicator 
deviation needle 
(horizontal) 

a or pitch error (0^), 
depending on PAI 
mode 

Same as above 

Same as above 

Yes 

Sideslip 

indicator 

P 

Ball nose flow 
direction sensor or 
IFDS computer 
(depending on 
computed aip 
mode) 

Same as above 

Yes 

Precision 

heading 

indicator 

Heading error {y/e), 
roll rate (0) depending 
on roll rate mode 

IFDS IMU 

None applicable 

No 

Dynamic 
pressure vertical 
tape 

Dynamic pressure {q) 

Ball nose 

Accuracy 
degraded below 
Mach 2.5 

No 

Velocity vertical 
tape 

Earth-relative velocity 
magnitude (V) 

IFDS computer 

Accuracy 
degraded after 
~300 sec due to 
navigation error 

Yes 

Altitude vertical 
tape 

Inertial altitude with 
respect to reference (h) 

IFDS computer 

Same as above 

Yes 

Altitude rate 
vertical tape 

Inertial altitude rate 

(h) 

IFDS computer 

Same as above 

Yes 

Normal 
acceleration 
vertical tape 

Normal acceleration 

Az(g) 

Self-contained 

None applicable 

No 


In normal operation, the X-15 pilot’s ADI in the eenter of the eontrol panel (Figure 6.7-3) was a 
standard freely rotating sphere ealled the “8-ball.” The sphere was bisected into white and black 
areas representing sky and earth, respectively. The ADI was a critical instrument because the 
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typical X-15 ballistic flight profile prevented pilots from seeing Earth’s horizon until reentry and 
the degree of precision flying required by the mission demanded constant reference to flight 
instruments until landing. Moreover, the pilot was dependent on the ADI to perform the 
experimental maneuvers with the required precision. Normally, the needles labeled “8a” and 
“8b” in Figure 6.7-3 indicated a error from preset and P error from zero, respectively. Needle 
“8c” displayed error from a ground preset of the pitch attitude desired during climb. Needle 
“8d” indicated error from a ground preset heading. 



Figure 6. 7-3. X-15-3 Attitude Director Indicator 

However, the ADI in the X-15-3 aircraft was modified to an alternate display configuration, 
called the PAI, which was needed to perform scheduled experiments with the desired precision. 
Switches on the display panel upper right section controlled the functions of the horizontal and 
vertical needles independently (in the PAI mode, they indicated pitch- and roll-attitude errors, 
respectively, rather than pitch and yaw). This was a major design departure for a performance 
instrument considered critical to maintaining controlled flight. This design was incorporated 
because the X-15 instrument panel had limited area available. 

An additional complexity of the ADI in either of its modes was that the standard ball nose air 
data system, which provided a measurement of a and fi, was not reliable at dynamic pressures 
less than about 50 psf. When the pilot received the displayed information that the dynamic 
pressure was less than 50 psf, he was expected to use a switch to change the source of a and 
P data for the ADI displays from the ball nose to an inertially computed source. 
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7.0 Accident Detail 

Flight 3-65 on November 15, 1967, was planned as an altitude flight. The pilot was condueting 
his seventh X-15 flight and his third flight in X- 15-3. The flight was attempted 2 weeks earlier 
on Oetober 31, 1967, but was aborted prior to launeh due to a propulsion system issue. 

The two flights immediately preeeding Flight 3-65 were high-altitude flights and were made with 
the aircraft in nearly the same configuration. The only configuration exceptions were that, for 
purposes of performing additional aero thermal and aerodynamic experiments on Flight 3-65, a 
panel of ablative material was added to the left-hand upper speed brake to test the adhesive and 
insulating properties of a material proposed for use on the Saturn launch vehicle, and a traversing 
probe experiment was added to the starboard wing pod.'’ 

7.1 Flight Plan 

The flight plan for this altitude flight was similar to prior altitude flights. X-15-3 was to launch 
from Delamar Dry Lake, Nevada, at an altitude of 45,000 feet and depart southwest toward 
NASA FRC on a heading of 216 degrees magnetic (232 degrees true). There were eight primary 
science objectives, including boost guidance evaluation, solar spectrum and plume measurement 
experiments, the traversing probe experiment, micrometeorite collection, ablative materials 
testing, and several instrumentation tests. Orienting the aircraft during the ballistic coast 
involved use of a PAI mode of the ADI display to perform a tracking task at or near peak altitude 
such that the solar spectrum experiment located in the aft experiment compartment could be 
oriented toward the sun. The flight plan called for a maximum velocity of 5,100 fps, a maximum 
altitude of 250,000 feet, and a maximum entry dynamic pressure of approximately 820 psf. 
Emergency procedures and landing sites were established for major subsystem failures, including 
premature engine shutdown. 

7.2 Timeline 

The pilot entered the cockpit at approximately 08:15 Pacific Standard Time (PST), and the 
NB-52 carrier aircraft departed Edwards Air Eorce Base for the launch lake at 09: 12 PST. The 
carrier aircraft was enroute approximately 1 hour and 1 5 minutes before making the final turn to 
align with the launch azimuth. All captive-carry systems checkout procedures were normal, 
except for a peroxide leak from a yaw RCS jet, which was determined to be of no consequence 
prior to launch. Most X-15 instrumentation and systems, including the traverse probe 
experiment, were activated prior to launch. The traverse probe experiment was powered on at 
10:27:20 PST with the flight data recorders. 


® Wing pods were not part of the original X-15 design, but had been aerodynamieally qualified for use and were 
safely demonstrated on several flights prior to Flight 3-65 and on the X-15-1 and X-15-3 airframes. 
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Launch from the NB-52 took place at 10:30:07 PST with all systems operating normally. 

Ignition oceurred at 10:30:08 PST (mission elapsed time (MET) +0 seconds)^. During the final 
40 seconds of the power-on phase, a gradual ji to about 5 degrees nose left was noticed by 
ground control. This deviation was considered normal and was attributed to engine 
misalignment.^ 

Radio communications throughout the flight were reported to be poor, but this was not 
considered unusual during high-altitude missions [ref 3]. However, in this case eommunications 
with the pilot were intermittent throughout the entirety of the powered flight phase and did not 
become intelligible until after the end of the powered flight phase. 

At 10:31:28 PST (MET + 80 seeonds) just prior to engine shutdown, whieh occurred at 
10:31:30 PST (MET + 82 seeonds) and at about 140,000 feet altitude, the lEDS computer and 
instrument malfunction lights illuminated, indicating an lEDS malfunction. Eight seconds later, 
the pilot attempted to reset the system, but malfunction light stayed on. The lEDS continued to 
malfunction, and the warning light could not be reset. 

At 10:31:34 PST (MET +86 seeonds) and about 154,000 feet altitude, the pilot reeeived ground 
control instruction to switch the ADI to the PAI mode. Due to poor radio communication 
conditions, this message was relayed via the NB-52 crew. The pilot had switched the ADI into 
PAI mode at 10:31:33 PST (MET + 85 seconds) in accordance with the flight plan, even though 
that mode was not required until the precision attitude-tracking task later in the flight. 

At 10:31:42 PST (MET + 94 seconds) ground control called for the wing-rock maneuver, 
which the pilot had initiated at 10:31:37 PST (MET +89 seconds). At 10:31:58 PST 
(MET + 110 seconds), the pilot reported the computer and instrument malfunction lights were 
on. Ground control acknowledged the pilot’s report. 

The wing-rock maneuver was eompleted at 10:32:20 PST (MET + 132 seconds), at which time 
the aircraft had started a slow yaw drift to the right. 

Although ground control had acknowledged that the IFDS computer was malfunctioning, at 
10:32:09 PST (MET +121 seconds) and about 220,000 feet altitude, the pilot was instructed to 
perform the computed a/y5-check maneuver using the display of IFDS computed a and fi when 
the altitude reached 230,000 feet. The pilot performed this maneuver immediately following 
completion of the wing-rock maneuver at 10:32:20 PST (MET +132 seconds). During the 
maneuver, the RCS did not respond normally to pilot inputs. The pilot delayed depressing the 
computed alfi switch for several seconds, possibly due to his attention to the control malfunction. 
The pilot seleeted IFDS a/ji at 10:32:23 PST (MET + 135 seconds). At this time, the aireraft was 


’ For clarity, the present report adopts the convention that MET + 0 seconds coincides with ignition. The AIB report 
uses range clock time only. 

* The ventral fin had been designed in part to reduce P due to thrust misalignment, but the program elected to fly 
high-altitude flights without the ventral fin after fall of 1962, which probably increased the ’’expected” power-on p. 
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sideslipping approximately 6 to 8 degrees nose right, as displayed by the precision heading and 
P indicators. The aircraft roll attitude was nearly wings level and the ADI vertical wand 
displaying roll in PAI mode did not indicate any significant error. 

By 10:32:25 PST (MET +137 seconds), the negative side fi slip deviation had increased to 
off-scale nose right as displayed by the cockpit precision heading and indicators. At this time, 
lacking a control room indication of heading information, ground controllers were not aware of 
the heading error. 

Immediately after selecting IFDS a/fi, the MH-96 AFCS disengaged automatically at 
10:32:26 PST (MET + 138 seconds), illuminating a caution light. The pilot recognized that the 
light was on and immediately reset the MH-96 while concurrently reporting to ground control 
that the pitch and roll stability augmentation channels had disconnected. The MH-96 was 
re-engaged by the pilot at 10:32:31 PST (MET + 143 seconds). 

At approximately 10:32:50 PST (MET +162 seconds), the pilot initiated the Precision Attitude 
Tracking Task in accordance with instructions from ground control. At this time, the P angle had 
increased to 20 degrees. The RCS momentarily resumed normal operation, arresting the positive 
yaw rate. However, due to a lack of normal response from the AFCS right-hand reaction control 
inceptor, at 10:33:05 PST (MET + 177 seconds) the pilot elected to use the left-hand manual 
control inceptor. The pilot did not disable the AFCS, although normal procedures for transition 
to manual control would have required this action. By the time the pilot began to use the manual 
control inceptor, the aircraft had rolled left through zero bank angle and the precision roll 
indicator needle called for the aircraft to be rolled to the right. However, the pilot applied 
manual right-yaw reaction control, further increasing the deviation from the planned heading. 

At 10:33:14 PST (MET + 186 seconds) and about 258,000 feet altitude, ground control 
instructed the pilot to check the status of the pitch and roll dampers. The pilot reset them 
manually at 10:33:21 PST (MET + 193 seconds). 

The aircraft entered a spin at approximately 10:33:30 PST (MET + 202 seconds) at an altitude of 

250.000 feet and a velocity of 5,000 fps. At 10:33:39 PST (MET + 211 seconds) and about 

240.000 feet altitude, the pilot reported that the aircraft control seemed “squirrelly.” At 
10:34:01 PST (MET + 233 seconds), the pilot transmitted, “Em in a spin.” At that time, the 
aircraft had reached peak altitude and was in a descent through 210,000 feet. The aircraft 
attitude was approximately 40 degrees above the horizon and was approximately 90 degrees 
right of the planned heading with a roll rate of 20 degrees per second. The aircraft had 
completed one yaw revolution. The dynamic pressure in this flight condition was increasing 
through approximately 1 .5 psf. At this time, reaction controls were still required. The pilot 
reported the spin a second time at 10:34:16 PST (MET + 248 seconds). 

The aircraft continued uncontrolled motion until about 10:34:34 PST (MET + 266 seconds), 
where at an altitude of approximately 130,000 feet, the spin was arrested by a combination of 
automatic and manual reaction controls, aerodynamic controls, and inherent aerodynamic 
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stability. At this point, the aircraft had a velocity of about 4,700 fps and was subject to a 
dynamic pressure of about 200 psf 

At about 10:34:37 PST (MET + 269 seconds), within seconds after the aircraft came out of the 
spin and went into an inverted dive, the MH-96 AFCS entered into a divergent limit-cycle 
oscillation in the pitch axis with the stabilators moving at their maximum rate of about 
26 degrees per second. As dynamic pressure increased during rapid descent, the horizontal 
stabilizer motions produced rapidly increasing accelerations that exceeded structural limits. 
By-products of the MH-96 AFCS limit-cycle instability in pitch were rolling and yawing 
oscillations that produced excessive structural loads. 

At 10:34:54 PST (MET + 286 seconds) at an altitude of 62,000 feet and a dynamic pressure 
exceeding 1,300 psf, a catastrophic buckling of the fuselage occurred and the aircraft 
disintegrated into several large fragments. The pilot did not successfully eject and was killed 
during the breakup or upon ground impact. 

7.3 Data Reconstruction 

Reconstructed flight data depicting key events with respect to the aircraft attitude angles are 
shown in Figure 7.3.1. These data were derived from filtered measurements of the IMU resolver 
angles recovered from the original stripchart recordings. The correctness of the IMU angle data 
was verified by the post-accident investigation team via correlation of the estimated attitude with 
a kn own solar angle in recovered film footage from onboard cameras [ref. 3]. The remaining 
trajectory data appear in Appendix B. 

In Figure 7.3-1, MET is referenced to ignition, which occurred at 10:30:08 PST. The onset of 
spin entry at approximately 10:33:30 PST (MET + 202 seconds) was based on the rapid increase 
in yaw rate and the observation of the first traversal of the sun across the instrument panel as 
seen from the cockpit camera. Note that the aircraft was tumbling after approximately 
MET + 215 seconds, and the attitude resolver angles wrap through 360 degrees, but are masked 
by noise filtering. 

Based on the assumption the pilot recognized the spin entry about 3 1 seconds prior to reporting it 
(when the sun traversed the instrument panel), just over 1 minute elapsed during the pilot’s 
attempts to regain control until the aircraft was destroyed. 
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Figure 7.3-1. X-15 3-65 Reconstructed Flight Data (attitude angles^) 

8.0 Failure Analysis 

In the following subsections, analyses of individual subsystem failures and their effects will be 
detailed. These include the failure of the traverse probe experiment; the subsequent 
instrumentation, RCS control, and display anomalies; and the development of the MH-96 large- 
amplitude limit cycle. In Section 9.0, an analysis of the human factors related to the accident 


^ Although not indicated in the original flight data, based on [ref. 11] it is assumed the Euler angles are referenced to 
a geodetic north, east, down (NED) frame centered at the landing site. The Euler sequence is unknown, but was 
probably 3-2-1. 
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will be detailed, with a focus on piloting performance and the role of ground control in the 
incident. 

8.1 Traverse Probe Experiment Failure 

The traverse probe contained in the starboard wing pod consisted of a servo-controlled pressure 
boom whose design was such that it would oscillate across the bow shock boundary, providing a 
measurement of the shock location. The traverse probe relied on power from the aircraft and 
was interfaced to the primary 1 15 V (volt) 400-Hz (Hertz) alternating current (AC) power bus 
supplied from the aircraft APU generators. The traverse probe experiment had been flown on 
two prior missions in 1963, although neither achieved an exceptionally high altitude [ref. 4]. 
Flights 1-35-56 and 1-36-57 on the X-15-1 airframe reached maximum altitudes of 124,200 and 
1 1 1,800 feet, respectively. No anomalies related to the traversing probe were noted on these 
flights. 

Post-flight tests of the reconstructed traversing probe hardware concluded that below pressures 
corresponding to approximately 90,000 feet pressure altitude, a starting capacitor associated with 
the traverse probe drive motor would first develop a corona discharge and then exhibit arcing to 
ground across an approximately 0.25-inch gap between the capacitor terminal and the 
experiment chassis. Continued testing revealed this behavior would persist until power supply 
line fuses, rated at 2 amps, interrupted the power to the traverse probe motor. This interruption is 
consistent with the cessation of the electrical disturbance prior to the pilot and aircraft loss 
during Flight 3-65, and it was verified the flight fuses recovered from the wreckage exhibited 
characteristics consistent with the fuse burn-through reproduced on the ground [ref. 3]. 

Dielectric breakdown in low-pressure gases is a known phenomenon in high-voltage systems 
[refs. 30-32]. Dielectric breakdown phenomena obey the semi-empirical Paschen’s Law, which 
describes the minimum breakdown potential (in V) associated with a parallel plate electrode 
configuration as a function of the product of pressure and gap distance {pd). The breakdown 
voltage approaches a minimum at a specific value of the pressure-gap product and increases 
elsewhere (see Figure 8.1-1, reproduced from data appearing in reference 32). 

Paschen’s Law implies, for a fixed gap distance and potential, the likelihood of breakdown 
increases until reaching a maximum at a specific absolute dielectric pressure and then decreases 
as the dielectric pressure approaches zero. The result is counterintuitive, but is driven by the 
physics of the underlying electron transport phenomena and ionization processes. The shape of 
the Paschen curve for a given dielectric depends on the gas composition and its temperature. 
Breakdown may be influenced by electrode composition and contaminants, and particularly in 
space environments, by electrons liberated by incident radiation. 
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Figure 8.1-1. Paschen Curve for 400 Hz Potential at 300 degrees Kelvin [ref. 32] 

Even at the critieal pd value, quieseent breakdown in air generally will not occur below 300V. 
However, deviations from the basic Paschen law result from various factors, including the 
presence of nonuniform or oscillating electric fields (e.g., conductors with sharp radii and AC 
potentials, respectively). In the latter case, 400 Hz AC potentials as were used in the X-15 
AC power bus reduce the threshold to about 230V. Unknown to the traverse probe experiment 
developers, the commercial-off-the-shelf (COTS) AC motor selected from existing inventory 
contained a transformer circuit that multiplied the 1 15 V input by a factor of about 4, yielding a 
peak potential in the experiment exceeding 630V. Under reduced-pressure conditions, arcing 
was practically guaranteed across uninsulated gaps of modest spacing. As the design was not 
thoroughly reviewed for environmental compatibility or tested in simulated altitude conditions 
prior to installation on the aircraft, the breakdown phenomena was first seen in flight. The 
investigating board theorized that during the relatively short exposure to the high-altitude 
environment on the previous two flights, arcing may have occurred, but could have gone 
undetected as no particularly sensitive electronics were installed on the other X-15 aircraft 
[ref 3]. 

The effects of the traverse probe electrical disturbance during the accident flight were severe. 
Post-accident laboratory testing indicated that 30 //s transient spikes of at least 300V would 
appear on the aircraft power bus and would be transmitted to all common-ground electrical 
components. Systems that operated on 28V direct current (DC) power and/or had robust power 
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supply electronics (e.g., the IFDS IMU) were not substantially impacted. However, the majority 
of the electronic and electromechanical systems, including the servoactuators, MH-96 AFCS 
gain changer electronics, IFDS computer, and telemetry and voice transceivers, were affected. 

8.2 IFDS Computer Failure 

The IFDS installed on the X-15-1 and X-15-3 airframes consisted of a digital inertial computer 
and an analog stable platform (IMU) that was originally designed and environmentally qualified 
for the X-20 program. The digital component of the IFDS contained the mechanization of the 
navigation equations and was used to accumulate (integrate) velocity data from the stable 
platform and transform this information into a coordinate frame suitable for use by the pilot and 
the boost guidance algorithm. The principal IFDS outputs were the altitude, altitude rate, and 
Earth-relative velocity magnitude. In addition, body-relative velocity vectors were used to 
establish estimates of a and p. 

By 1960s-era accuracy standards, the IFDS IMU was a coarse aviation-grade instrument with a 
gyro bias in the range of 3.0 deg/hr, and an acceleration sensitivity of approximately 10 /^G. 

As such, it was shown to be useful only during the boost and ballistic phases of flight, after 
which accumulated errors tended to yield estimates of aircraft state too inaccurate for use in 
safety-critical ranging decisions. However, while range radar was relied upon for determining 
energy during and after entry, the use of IFDS for pilot situational awareness was common. 
During Flight 3-65, the accuracies of the computed a and fi were being experimentally evaluated. 
Nevertheless, flight planning called for the IFDS to replace the air-data derived indications of 
these quantities on the pilot display panel at dynamic pressures below 50 psf 

At the onset of the Flight 3-65 electrical disturbance, the IFDS began a series of resets. In each 
case, transient upsets to the power supply induced as a result of the traverse probe breakdown 
phenomena caused the IFDS to temporarily halt integration of the navigation equations and 
resume shortly thereafter. This event occurred at least 61 times [ref. 3] during the less than 
3 minutes of electrical disturbance. Due to the loss of integrated velocity during the halt period, 
a substantial error, on the order of 100,000 feet and 1,000 fps, accumulated in the IFDS estimates 
of the altitude and velocity. Importantly, the failure in the IFDS did not affect the ADI ball. 
Therefore, the pilot’s indications of gross and fine (PAI) attitude were correct throughout the 
flight. The same telemetered indications of the aircraft attitude, derived from the IMU resolver 
angles, were independently used to drive the ADI ball servos [ref 11] and were unaffected by the 
IFDS dropouts. This conclusion can be verified by comparing the sun and shadow angles in the 
cockpit with the position of the ADI ball, and by noting that the IFDS GROSS failure indicator 
was not illuminated in the cockpit film [ref. 3]. 

The principal effects of the IFDS failure were erroneous indications of altitude, altitude rate, total 
velocity, a, and fi on the pilot displays. While the aircraft control was lost in part due to an 
unrecognized P deviation at a point in time that the IFDS was selected as a source of P 
information, and while the timeline reveals that the data was likely in error, the IFDS output was 
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off-scale and with the correct sign at the time the pilot selected it. Thus, the erroneous data from 
the IFDS do not appear to be a direet contributor to the vehicle loss of control. However, the 
deteriorating state of the IFDS displays, especially in that the altitude and velocity tapes were 
substantially different from the expected values, combined with repeated warnings from the 
IFDS error annunciator suggests that the pilot was suspect of any data originating from the IFDS. 
This may have contributed to a loss of spatial orientation, which is discussed in further detail in 
Section 9.0. 

The susceptibility of the digital IFDS eomputer to power supply transients was a kn own 
problem, but regrettably, it had been considered benign and/or unlikely since it had apparently 
only occurred on X- 15-1 and was suspected to have been due to a particularly high electrical 
load. As of July 1968, the problem on X-15-1 was still unresolved, but under investigation 
[ref 11]. 

8.3 Servo Transient Anomaly 

An anomaly highlighted in the 1968 NASA/Air Foree AIB report was the presenee of servo 
transients whose behavior could not be reconciled with any kn own cause [ref. 3]. Servo 
transients were considered a benign behavior, but due to the nature of the MH-96 AFCS, any 
uncommanded, rapid servo motion could be interpreted as an excessively high servo limit cycle, 
thus triggering a momentary drop in gain. The AIB reported the X-I5 had operated for some 
time with the servo transient issue and the momentary gain reduetion (on the order of 5 to 
10 seconds) was often unnoticed by the pilot. 

The X-15 servoaetuator assembly was a two-stage hydraulie power-boosted design operated in 
series with direct pilot mechanical inputs to the aerodynamic surface power actuators [ref. 24]. 
The servocylinder torque motor and servocylinder feedback electronics had a relatively high 
eleetrical sensitivity to current transients [ref 29]. Given the extent of the eleetrical anomaly 
caused by the traverse probe failure, the most plausible explanation for the excessive servo 
motion is that a known and poorly characterized sensitivity to electrical interference in the servo 
was exacerbated by the severe electrical noise. 

Servo transients during Flight 3-65 had two distinct and equally problematic effects. First, the 
aforementioned coupling with the gain changer electronics caused the MH-96 to interpret the 
occasional servo motions as excessive servo limit cycles, and the MH-96 correctly responded by 
rapidly decreasing the gain to recover stability. In doing so, the hysteresis logie assoeiated with 
the automatic RCS blending was activated, and the RCS was disengaged. The pilot was not 
notified of the disengagement. 

Second, the MH-96, similar to the other X-15 SAS designs, included a failure monitor circuit on 
each servocylinder to protect for hardover failures. Hardover failures were considered credible 
anomalies and were proteeted for, when detected, by a eomplete disengage of the associated roll, 
pitch, or yaw axis [ref. 24]. Both systems used a simulated servocylinder model implemented 
using analog electronics. In the baseline SAS, the hardover detection circuit consisted of an 
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absolute travel error monitor that was triggered when the expected value of the servo position 
exceeded the measured value by more than 10 percent. In the MH-96, detection was triggered 
when the rate of the servo travel differed in sign from the expected rate. In the event of a 
“damper reset,” two lights were illuminated on the panel to notify the pilot, and pilot action was 
required to re-engage the failed channels by returning the damper select switches to the “up” 
position. 

To reduce the potential for supercritical operation in the event that the MH-96 was disengaged at 
a low dynamic pressure condition and re-engaged at a high dynamic pressure condition, the gain 
changer electronics were configured to reset the gain to minimum following any reset. Under 
normal conditions in exoatmospheric flight, the adaptive gain would return to maximum in 
10 to 20 seconds. A reset would interrupt access to the RCS during that time. 

During Flight 3-65, a servo monitor disengage, precipitated by a large servo transient, occurred 
simultaneously in the pitch and roll channels at 10:32:26 PST (MET + 138 seconds). This 
condition was immediately recognized and reset by the pilot in about 4 seconds. However, since 
the yaw channel was severely affected by the traverse probe electrical noise, the sum of adaptive 
gains did not return to a value sufficient to reactivate the RCS for nearly 20 seconds after the 
channels were reset [ref 3]. A similar disengage manually triggered by the pilot occurred about 
1 minute later when the pilot was asked by ground control to “check [his] dampers.” This 
manual action interrupted access to the RCS. 

8.4 Yaw Rate Gyro Channel Disconnect 

In addition to the hardover monitor responsible for the pitch and roll axis disengage, each of two 
redundant channels of each axis in the MH-96 architecture included a rate hardover monitor on 
the flight control rate gyro. An ability to recover from a flight control rate gyro fault was a 
requirement of the MH-96 design, but a simultaneous failure of both gyros in a single axis was 
not considered credible. Thus, the architecture was designed so a single failure could be 
accommodated by disconnecting the failed gyro, in which case the total adaptive gain (i.e., the 
sum of both channels) would automatically increase to return the total system gain to a normal 
range [ref 29]. Unlike the case of a servo failure detection, the adaptive channels were not 
disengaged. 

The flight envelope provided to the MH-96 designers specified the range of angular rates in each 
axis would not exceed 20 degrees per second, and the gyro output amplifiers were designed to 
saturate at 30 degrees per second. As such, the hardover monitor threshold in pitch and yaw was 
empirically set to a value of approximately 22.5 degrees per second. The roll channel used a 
differential trigger, but essentially operated the same way. 


The exact value of the threshold differs. This value is taken from the MH-96 engineering documentation, 
WADD-TR-60-651 Part VII, whereas the AIB report specifies 30 degrees per second, which was probably confused 
with the gyro saturation limit. 
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During Flight 3-65, the onset of a spin brought the true body yaw rate above the hardover-failure 
diseonnect threshold simultaneously in both yaw channels, which were operating normally. As 
designed, both channels simultaneously disconnected, essentially opening the yaw damper loop 
and providing no yaw rate feedback from approximately 10 seconds after spin entry until 
10:34:29 PST (MET + 261 seconds) when the disconnect circuits reset and re-enabled both 
channels. No indication of the open condition in the loop was provided to the pilot. Lacking any 
closed-loop feedback, the MH-96 total gain in yaw increased to maximum and remained there so 
that RCS control was available to the pilot so long as the pitch and yaw gains were near 
maximum. However, regardless of the RCS state, the pilot had transitioned to the left-hand stick 
and RCS yaw rate damping was unavailable due to the lack of rate gyro inputs. The primary 
effect of this failure was to exacerbate spin development with no rate damping augmentation. 

8.5 MH-96 Large-Amplitude Limit Cycle 

The AIB report provides little detail regarding the MH-96 ECO that contributed to the aircraft 
breakup. To isolate the most probable cause of the MH-96 instability, an extensive analysis was 
undertaken to gain insight into the exact mode(s) of failure (see Appendix A). The AIB report 
indicated the rate-limited power actuator was a contributor, and it appeared the large-amplitude 
ECO could be sustained in the event of rapidly increasing dynamic pressure, as was seen during 
the entry of Flight 3-65. However, a review of the trajectory data revealed the maximum 
dynamic pressure rate of change was less than seen on previous flights, and the MH-96 adaptive 
gain law provided sufficient response to maintain gains below supercritical operation in these 
conditions. Furthermore, it appears the presence of supercritical gains in the MH-96 would 
seldom lead to a loss of rigid-body stability, but rather to an excitation of the servo-limit cycle 
mode to a higher, but nondestructive amplitude. 

The present analysis revealed the AFCS, coupled to the X-15-3 airframe at a hxed flight 
condition above approximately Mach 3.0, could exhibit two distinct oscillation modes. The first 
was dominated by the desired limit cycle associated with small-amplitude surface motion at the 
critical forward gain with no rigid body motion. The second was a divergent large-amplitude 
LCO^' involving the rigid body, but not directly involving the adaptation dynamics. The 
presence of the divergent ECO appears to have been the result of a latent design oversight in a 
structural notch filter installed on the MH-96 configuration. 

8,5,1 History 

In May I960, a severe high-frequency ECO in the baseline (fixed-gain) stability augmentation 
system was discovered during a X-15-2 flight, which involved a 12- to 13-Hz oscillation in a 
stabilator resonant mode at certain flight conditions [refs. 1, 6, 24, and 33]. 


" “Divergent” LCOs are oseillations that grow to suffieient amplitude to eause divergent (destruetive) aireraft 
dynamies before reaehing their theoretieally limiting behavior. 
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The NASA FRC maintained the fixed-gain SAS for X- 15-1 and X-15-2, and underwent a 
redesign of the fixed-gain SAS filters to mitigate the high-frequency LCO. The FRC 
engineering personnel were aware of the nonlinear saturation and rate limiting characteristics of 
the power actuators, and incorporated these features in their design model when developing the 
filter modifications [ref. 34], The modified filter was verified through hardware-in-the-loop 
simulation and installed on both fixed-gain SAS airframes, where flight tests confirmed the 
elimination of the high-frequency LCO. No further issues were seen on the fixed-gain system. 

In late 1960, a basic model of the problematic structural mode was sent to the MH-96 contractor 
for evaluation. At the time, the contractor was in the late stages of preparing the MH-96 for 
flight qualification tests, which were scheduled to begin in the fall of 1961 . The contractor 
reviewed the structural model and concluded that a notch filter would be needed in the rate 
damping loop to mitigate the issue. An appropriate fdter was designed, fabricated, and 
incorporated into the MH-96 design [ref. 35]. 

The redesigned MH-96 was installed and tested at FRC in the Hardware in the Loop (HWIL) 
facility and in September 1961 was installed on the aircraft for ground testing. During ground 
aircraft testing, an additional unstable inertial-servoelastic coupling effect appeared in the 
closed-loop dynamics. The designers were challenged by the appearance of an additional 
adverse structural-mode limit cycle caused by the notch filter due to the additional lag at higher 
frequency. Additional filter modifications were made, with a reduction in authority of the 
adaptive gains and the installation of a deadband, to ensure that the small-amplitude oscillation 
would not appear in flight [ref 35]. 

Due to facilities problems and other practical limitations, the HWIL and ground testing was not 
extensive, and the modified MH-96 was moved forward to begin preparation for initial flight 
tests in only a few months. The first flight test was conducted on December 20, 1961 . 
Notwithstanding a yaw channel oscillation at approximately 12 Hz caused by excessive gain in 
the lateral acceleration loop, the filter modifications proved successful in mitigating the risk of a 
high-frequency limit cycle caused by the stabilator dynamics. 

However, while NASA FRC had used a nonlinear model of the servo and power actuator with 
more extensive HWIL simulation to verify the filter design, the contractor apparently did not 
have access to the same type of model data and used a simple first-order lag model with 
hysteresis only (Figure 8.5-1). As such, a latent design sensitivity was introduced into the inner 
loop of the MH-96 SAS that would allow the SAS rate loop to become unstable in the presence 
of actuator rate saturation. 


X-15-3 had been rebuilt following the eatastrophie propulsion test failure. 
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NASA FRC Model of Power Actuator (excluding servo) 
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Figure 8.5-1. Surface Actuator Models Used in Design [refs. 34 and 35] 

8,5,2 Mode of Failure 

The transition from the desirable small-amplitude LCO to the large-amplitude destructive LCO 
was an artifact of the rate-limited power actuator with its semi-integrating servo loop. A known 
effect of power actuator rate limits is the introduction of an amplitude-dependent equivalent 
phase lag in the inner loop, which plays an important role in the sensitivity to pilot-induced 
oscillations (PIO). As can be seen in Figure 8.5-2, the presence of rate limits severely degrades 
the equivalent nonlinear frequency response of the X-15 actuator. The severe landing PIO 
encountered on X-15 Flight 1-1-5 was an effect of the same rate-limited actuators, albeit in a 
different failure mode [ref 36]. 

The adverse high-amplitude limit cycle behavior was not directly related to the AFCS adaptation 
dynamics, but to the SAS loop linear filter design, which differed from the linear filters used in 
the fixed-gain SAS on the other X-15 aircraft. Since the MH-96 required special loop shaping to 
attain the desired LCO conditions, the AFCS’s high-order notch filter induced substantially more 
phase lag near the rigid body short period frequencies. The mechanism by which a destructive 
limit cycle could be introduced involved an abrupt maneuver at relatively high forward gain, 
where the power actuator would reach rate saturation while inducing large angular acceleration 
on the rigid body. If this event occurred at a flight condition where the rigid-body short period 
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damping was particularly low, as it did during Flight 3-65, then the rigid-body oscillation was 
divergent, even with fixed adaptive gains. 



frequency (Hz) 



frequency (Hz) 

Figure 8.5-2. X-15 Power Actuator under Rate Saturation, 15-degree Ampiitude 

During entry, the X-15 bare airframe exhibited a short-period pitch mode of approximately 
0.5 Hz with a damping ratio of less than 10 percent while at a flight condition between 
Mach 4.5 and 5.0 [ref. 37]. In an environment of increasing dynamic pressure, especially rapid 
entries, the system gains were often supercritical for a few seconds until the desired limit cycle 
was established and the MH-96 gain changer reduced the gain. This unfortunately meant that 
rapid inputs at these flight conditions were accompanied by large servo commands that could 
saturate the power actuators. This was especially true for combined pitch-roll maneuvers due to 
the shared stabilator authority. While the adaptation dynamics were not directly involved in the 
LCO phenomenon, the limiting circuitry associated with the MH-96 adaptive loop could be 
saturated by large DC signals [ref 33]. If this occurred, then the gains would ramp to maximum 
in an effort to reestablish the desired high-frequency limit cycle. This behavior further amplified 
the large-amplitude limit cycle, leading to a loss of rigid-body control. 

A comparison of the reconstructed rigid body limit cycle appears in Figure 8.5-3. Using fixed 
aerodynamic parameters consistent with the onset of the LCO at M= 4.7 and the entry dynamic 
pressure profile from reconstructed flight data, the LCO can be triggered by a large or abrupt 
control surface motion. This occurs during normal adaptation behavior that otherwise does not 
lead to adverse oscillations. The resultant motion is divergent and couples with the rigid body at 
a frequency of about 0.5 Hz. 
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Figure 8.5-3. X-15 3-65 MH-96 Servo Actuator LCO (simulated) versus Fiight Data 

The presence of this adverse operation mode apparently went unnoticed until Flight 3-39 on 
January 13, 1965, when the LCO appeared during the flight boost phase [ref 3]. It quickly 
attenuated due to decreasing dynamic pressure, which decoupled the rigid body from the loop. 
The MH-96 contractor conducted a study, which concluded that the adverse LCO could be 
avoided if such abrupt inputs in the pitch axis were avoided while dynamic pressure was rapidly 
increasing. This recommendation is consistent with the failure mode identified through the 
present analysis. Pilots and engineering staff were briefed of the possibility of such adverse 
behavior and cautioned regarding its effects [ref. 3]. The contractor report stated: 
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The MH-96 adaptive system can continue flying without modification if the 
following precautions are observed: avoid planning flights where large, rapid 
angle-of-attack changes might be encountered while simultaneously rolling the 
vehicle when at Mach numbers greater than 3. 0; brief pilots on the potential 
consequences of abrupt control motions, especially when in the flight conditions 
described above. If the above precautions are considered too restrictive, the 
nonlinear stability (pitch limit cycle) of the MH-96 pitch axis can be improved 
through modification. 

Replication of this behavior in simulation is non-trivial, as it requires a high-fidelity model of the 
power actuator, servocylinder, servo feedback, valve dynamics, and associated nonlinearities. 

The semi-analytical methods used in Appendix A to predict the instability were known in the 
1960s, but could not be exercised at the level of detail now available using rapid numerical 
simulations. However, there is some evidence suggesting this behavior had been encountered in 
HWIL simulation before it appeared in flight, as a brief report [ref. 38] contains plots of a 
large-amplitude roll oscillation that reappear in the 1971 report [ref 33] commissioned by the 
AIB. Therein, an X-15 controls engineer remarks: 

When a large... command is made, rate limiting occurs and causes [a] greatly 
deteriorated response... nonlinearities in system components cannot be ignored in 
high-gain control systems. 

It is reasonable to expect the X-15 flight control team, having had recent experience with a 
rate-limited PIO during the first piloted flight, could postulate the existence of a rate-limited 
large-amplitude LCO in the pitch axis. However, it seems this knowledge was not 
communicated to the program, or it was thought not to be a credible failure in flight, since 
according to the AIB it came as enough of a surprise in 1965 that a contract was issued to study 
its implications [ref. 3]. However, by the time of the accident, this behavior seems to have been 
known. A control room MH-96 monitor engineer remarks in a witness statement [ref 3]: 

...the limit cycle operation which occurred... is a rarely seen characteristic of this 
system which is undesirable and did prevent the pilot from having full... control 
capability. 

8,5,3 The Role of Adaptive Control 

The investigation following the 3-65 accident concluded from simulation studies that the adverse 
LCO could have been avoided had the pilot disabled the MH-96 and reverted to fixed-gain 
operation prior to entry. However, the AIB noted the pilot would have been unfamiliar with the 
LCO since he had not experienced it in the simulator [ref. 3]. Although the existence of this 
failure mode was known, it may have been difficult to reproduce on the ground since the HWIL 
simulation facility was seldom operated at full flight hydraulic pressures [ref 5]. 

It is unlikely that disabling the adaptive mechanism per se successfully recovered stability, but 
rather that the fixed-gain mode in X-15-3 reverted to the lowest acceptable gain, which was 
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below the threshold that would sustain rate limiting. While the adaptive mechanism exacerbated 
the problem by increasing the system sensitivity to large or spurious inputs, it is likely that an 
alternate filter design would not have been susceptible to this phenomenon. Pilots executing 
high-altitude reentries using the fixed-gain SAS typically did so with a pitch gain preset at 
40 to 60 percent of the maximum gain in that axis [ref 19]. Had the same structural filter been 
installed on the X-15 aircraft with the fixed-gain SAS, whose inner loop was functionally 
identical to the adaptive inner loop, the fixed gain controller may have exhibited the same 
unstable behavior at a higher dynamic pressure. 

Following the accident, the AIB concluded that a detailed failure mode analysis was 
unnecessary, since the only example of the MH-96 system in a flight configuration had been 
destroyed [ref 3]: 

The destruction of the only X-15 airplane equipped with an adaptive control 
system makes detailed recommendations in this area unnecessary. 

The AIB recommended that a report be released summarizing the general experience with 
adaptive flight control technology within 90 days [ref 3]. However, the report was released 
more than 3 years later in March 1971 [ref 33]. While this brief summary mentioned the 
severity of the pitch-and-roll axis limit cycle instability and its relationship to the actuator rate 
limits, it did not adequately discuss the contributions of the AFCS to the Flight 3-65 accident: 

An example of gain reduction caused by electrical noise is shown... in this 
particular instance, the performance of the AFCS became so poor that the pilot 
resorted to the use of the manual reaction control system, rather than continue to 
use the poorly performing AFCS blended reaction controls... 

...when these [pilot] commands were large or rapid, the effect on the gain 
changer was serious. In each flight incident, the gain changer was misled by the 
direct-current or low-frequency signals which were large enough to saturate the 
electrical limits, thus masking signals within the bandpass frequency range. The 
gain increased to values exceeding the critical gain, and the servoactuator loop 
became unstable... 

...saturation in one axis resulted in complete loss of control in the other axis. 

This problem occurred immediately following recovery from a high-altitude spin 
in the last flight of the X-15 airplane with the AFCS. 

The report refers the reader to an earlier document [ref. 6], which does not appear to have 
received widespread dissemination. The present authors conjecture that this critical lack of detail 
may have led to the commonly held misconceptions about the root causes of the Flight 3-65 
failure. 

It is regrettable that the role of the adaptation law in the development of the adverse limit cycle 
behavior has been largely misunderstood in the modern flight controls community and has been 
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incorrectly reported in the literature [refs. 7, 8, and 39]. In the cited examples, the X-15 airframe 
and eontroller models were used to simulate a loss of eontrol, but excepting magnitude 
saturation, the nonlinear actuator was not modeled, and the destructive limit cyele oseillation 
shown did not involve rate limiting. In these models, the failure was indueed by simulating an 
80-pereent asymmetry in stabilator control surface effectiveness (control surface damage), an 
event that is eompletely unrelated to the Flight 3-65 accident. 

9.0 Human Factors 

From a human faetors perspective, for Flight 3-65 the design of the pilot interface, the interaction 
of the pilot with the aircraft and with ground control, and the conduct of the program at the time 
of the aeeident were important aspeets of the event and are addressed in detail in this section. 

9.1 Critical Events 

Figure 9.1-1 illustrates the timeline of the major events leading to the loss of the pilot and the 
aireraft, and diagrams the sequenee of key events during the 3 minutes following the initial 
traverse probe electrical disturbance. Note that the timeline in Figure 9.1-1 ends at about 
10:34:17 PST (MET + 249 seconds), or about 37 seconds before breakup. The time history of 
the MH-96 AFCS gains is shown in Figure 9.1-2. 

Beginning at 10:31:07 PST (MET + 59 seconds), the eleetrieal disturbanee eaused erratic 
fluctuations in the automated gain eontrol from maximum to minimum as seen in Figure 9.1-2, 
which caused the pilot’s access to the RCS through the right side stiek to be intermittent 
throughout the 2-minute, 46-second duration of the eleetrieal disturbance. 

At 10:31:00 PST (MET + 52 seeonds), all three input gains to the aerodynamie controls were at 
their maximums so that the MH-96 had automatieally enabled RCS inputs and the pilot’s right 
side stick was operational at that point. Seven seeonds later, the total gain of the three 
aerodynamic controls had decreased below 75 percent of its maximum, so aeeess to the RCS was 
elosed by the MH-96. From then on, the pilot’s right side stiek RCS control was intermittent 
because of the erratie fluetuations in the automated gain controls due to the continuing electrical 
disturbance. The pilot was unable to detect the intermittent RCS control for nearly 3 minutes. 
Cockpit indicators showed that the engagement of the pitch and roll dampers was also 
intermittent during the electrical disturbance. 

At 10:3 1 :58 PST (MET +110 seconds), the pilot reported the IFDS computer- and the 
instrument-malfunction lights had come on and eould not be reset. Ground control 
acknowledged the pilot’s report. 

At 10:32:09 PST (MET + 121 seconds), ground control instructed the pilot to perform the 
scheduled experiment of the computed ot/y5-cheek maneuver, which required the use of the 
display of lEDS computed a and fi, even though the flight controller had acknowledged the 
pilot’s prior reports that the IFDS computer was malfunetioning. 
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Figure 9.1-1. 3-65 Event Timeline 

At 10:32:27 PST (MET + 138 seconds), the pilot reported that the pitch and roll dampers had 
tripped out. 

Despite the indications of aircraft system malfunctions, ground control seemed unaware of the 
pilot’s severe situation. At 10:33:01 PST (MET + 173 seconds), the flight controller told the 
pilot that he was looking “real good.” 


However, at 10:33:05 PST (MET +177 seconds), the pilot apparently noticed for the first time 
the aircraft’s lack of responsiveness due to the intermittent, and ultimately the deactivation of, 
access to the RCS through the right side stick and switched to direct control bypassing the AFCS 
using the left side stick. Normally, the procedure for switching to direct manual control would 
have involved deactivating the RCS “auto” mode or disabling the MH-96, but the pilot did not 
execute this step and continued to try to perform the precision attitude-tracking task. 


At 10:33:25 PST (MET +197 seconds), the flight controller again assured the pilot that he was 
“a little bit high,” but “in real good shape.” 
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However, 14 seconds later, at 10:33:39 PST (MET + 211 seconds) and about 240,000 feet, the 
pilot reported that the aircraft control seemed “squirrelly.” Twenty-two seconds later at 
10:34:01 PST (MET + 233 seconds), the pilot said, “Em in a spin.” Ground control did not 
acknowledge either of these transmissions. The pilot repeated, “Em in a spin,” at 10:34:16 PST 
(MET + 248 seconds). At 10:34:17 PST (MET + 249 seconds), the flight controller said, “Say 
again.” At 10:34:17 PST (MET + 249 seconds), the aircraft was in descent at 184,000 feet with 
a velocity of 5,100 fps. The aircraft would begin to break apart 37 seconds later. 
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Figure 9.1-2. AFCS Gain Variation during Fiight 3-65 
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9.2 Causal and Contributing Factors 

As in most accidents, the destruction of the X-15-3 during Flight 3-65 was due to a confluence of 
latent and proximate faetors. This review of the events from the human faetors perspective 
identified latent, proximate causal, and contributing factors. The contributing factors were those 
that exacerbated the causal factors. Although unlikely, it is conceivable that if certain 
contributing factors had not been present, then the pilot might have been able to recover control 
of the aircraft and effect a safe landing. 

9,2,1 Causal Factors 

A latent causal factor in the Flight 3-65 accident was the installation of experimental equipment 
(i.e., the apparatus for the traversing-probe experiment) without adequate certification. The 
eonsequences of the traversing-probe motor areing on Flight 3-65 show that the proeedures for 
designing and testing X-15 experimental flight equipment were incomplete. 

A proximate causal factor was the eonfiuence of aireraft subsystem failures and of ground 
control to alert the pilot to the possibility of control problems and of erroneous data as soon as 
indications of malfunctions were observed. The AFCS design, the pilot’s interface, and the 
ground control procedures eontributed to the pilot’s illusion that his aircraft was operating 
properly during almost 3 minutes when the electrieal systems were malfunctioning. The pilot 
and ground control should have recognized that the inability to reset the IFDS computer and 
instrument malfunction lights was an indication of a major subsystem failure, but it seems the 
system (including the pilot and ground control) tended not to eonsider the IFDS to be critical. 
While there was an indicator of the failure of the IFDS computer on the pilot’s display and while 
the MH-96 could detect and alert the pilot to numerous types of major component failures, there 
was no display to indicate that the MH-96 gain control was erratic. If the pilot had been alerted 
so that he could have ehanged to direct manual control and reverted to the fixed-gain mode of the 
MH-96 in a timely manner (e.g., when ground control observed indications of control problems 
during the wing-rock maneuver), then he may have been able to recover control. Therefore, the 
failure of the system to alert the pilot to the problem in the aircraft’s control and displays was a 
causal factor in the aceident. 

The failure in the system design was that there were no provisions for alerting the pilot to the 
erratic behavior of the automated flight control system, or to the erroneous information on 
aircraft a, fi, altitude, and altitude rate generated by the malfunctioning IFDS computer. Also, 
the intermittent aspect of the access through the AFCS to the RCS, which is an inherently 
on/off system, caused the pilot to assume that the system was operating properly for several 
minutes. As the AIB report [ref 3] states, access to the automated RCS was “propitiously” 
operating during the few brief instants when the pilot moved the right side stick control as he 
performed the first two tasks (i.e., the wing-rock maneuver and the computed a/y5-eheek 
maneuver) and as he initiated the precision attitude tracking task. The report states: 
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Since the MH-96 provides no visual indication to the pilot of reaction control 
system status, i.e., whether or not the system has been automatically selected, the 
pilot must rely on being able to detect rocket operation by sound, visual exhaust 
observation, or control response to determine if the reaction controls have been 
properly selected. Since no attitude-rocket firing occurred during the initial 
11-second engage time of the MH-96 reaction controls on Flight 3-65, it would 
have been virtually impossible for the pilot to detect that the system had 
automatically engaged and then disengaged 11 seconds later. 

Consequently, with no visual display of the failure, there was little possibility the pilot would 
have reeognized the intermitteney of his control based solely on aircraft response. 

Ground control was a contributor to this proximate causal factor because its primary principle 
was not followed. The AIB report states; 

The philosophy associated withX-15 research flights is to discontinue the 
research objectives when aircraft malfunctions impair safe recovery of the 
aircraft or when the pilot has become so overloaded with aircraft malfunctions 
and/or experiment tasks that he is unable to do either. 

This is the proper philosophy for flight-testing, but did not appear to have been effectively 
implemented during Flight 3-65. 

The AIB report states that ground control did not have access to all the information needed for 
effective and timely problem detection. If this was the case, then ground control was unable to 
perform its primary function of protecting pilot and aircraft safety in accordance with the 
philosophy the AIB had noted. It is hard to understand why the status of the critical automated 
RCS was not being monitored on the ground, whereas the aerodynamic control system 
servomotors were being monitored. The MH-96 AFCS should have been viewed as 
experimental equipment. In its key role as safety backup to the pilot in such an experimental 
flight, all critical flight information should be available to ground control regardless of whether 
or not it is available to the pilot. 

However, regardless of the lack of certain key information, ground control had substantial 
evidence of Flight 3-65 problems. The continuing fluctuations in the telemetered data with the 
indications of the IFDS malfunction should have been sufficient evidence of problems to status 
the pilot and potentially abort the mission. Within 80 seconds after the start of the electrical 
disturbance, ground control had several indicators of serious aircraft problems. These include: 

• At 10:31:07 PST (MET + 59 seconds), the telemetered data became and remained erratic 
for several minutes. For example, ground control was aware of continuing anomalous 
servo transients from these telemetered data. The AIB report states: 

The transient motion of the three servos was not due to pilot inputs or aircraft 
motion, but was apparently electrical and was of sufficient frequency content and 
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amplitude to drive all three control gains well below their normal values for the 
particular flight conditions at which it occurred. The gain reduction in all three 
channels was great enough to cause the primary reaction controls to 
automatically disengage. 

• Starting at 10:31:07 (MET + 59 seconds), the telemetered data on altitude and velocity 
differed from the radar data and was noted by ground control personnel. 

• At 10:31:58 (MET +110 seconds), the pilot reported the lEDS computer and instrument 
malfunction lights were on. The flight controller acknowledged the pilot’s report. 

• About 20 seconds later, during the wing-rock maneuver, a member of the ground control 
team reported to the flight controller that the pilot was having a control problem based on 
his observations of larger than normal pitch-roll servo excursions. 

• Simultaneously, the telemetered indication of f data, which was monitored by the flight 
controller, was observed to deviate to off-scale nose right indicating the aircraft had 
undergone a large heading deviation. 

• At 10:32:26 (MET + 138 seconds), disengagement of the pitch and roll dampers was 
reported by the pilot and acknowledged by the flight controller. 

The proactive approach to safety is to advise the pilot of a problem as soon as there is any 
indication of that possibility. Such a warning is mandatory even if it may be redundant. The 
failure of ground control to notify the pilot of a possible control problem as soon as they had a 
suspicion of a problem was a causal factor in the loss of Elight 3-65. 

Moreover, throughout the flight, ground control continuously assured the pilot that he was on the 
planned flight profile and instructed him to proceed with planned experiments despite the 
evidence of problems. Not only did ground control potentially delay the pilot’s recognition of 
the problem and cause him to discount the computer and instrument malfunction lights and the 
disengagement of the pitch and yaw dampers, but they also added to the pilot’s workload by 
instructing him to execute the experiments rather than focus on the problem. Eor example: 

• During the wing-rock maneuver, it became apparent to ground personnel monitoring the 
telemetry records that something was amiss with the aircraft control. Nevertheless, the 
flight controller instructed the pilot to continue with the computed a! f -check, maneuver. 
This experiment was a part of a continuing study to determine the highest altitude at 
which the ball-nose display could be considered reliable by comparing its indications of 
a and f with the values calculated by the lEDS computer. Ground control knew the 
lEDS computer was malfunctioning and there was a control problem, yet the pilot was 
instructed to proceed with this experiment that relied on the lEDS computed a and f. 

After 190 successful flights, the ground control personnel for Elight 3-65 may have become 
complacent and may have chosen to ignore the reported evidence of a problem onboard the 
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aircraft. The flight controller appears to have been unable to recognize the integrated 
significance of the several indications of problems that were reported by the pilot and ground- 
control personnel. Evidence of this failure is in the following testimony reported by the AIB 
[ref. 3]. A member of ground control during Flight 3-65 testified: 

“The first problem indication was the computer malfunction light call from the pilot. 

1 did not hear him call reset. The next thing was pitch-roll damper dropout, and reset. ... 
With the apparent A/C problems I asked the controller to have the experiments closed.''' 
The flight controller did not request that the science objectives be terminated until at least 

2 minutes later, after the pilot had reported the development of a spin. 

Another ground eontrol member testified: 

“Upon initiation of the planned roll maneuvers, the pilot appeared to have a roll 
control problem as evidenced by larger than normal pitch-roll servo excursions. 

.... stop to stop excursions continued on the pitch-roll servo traces. In addition, 
the ball nose f indication moved off scale, showing the aircraft nose right. Ball 
nose a and f are not used for flight guidance during the ballistic portion of 
altitude flights. ” 

The flight controller did not eonsider this evidenee of continuing control problems. 

In addition, the flight controller continually assured the pilot that he was “on track” and “on 
heading.” The pilot and flight controller were aware that heading information eould not be 
determined from radar track data. No display of heading information (e.g., telemetered IMU 
yaw data) was available in the control room. Although the ball nose data correctly indicated a 
large f angle, it was discounted by the flight controller due to his past experience with unreliable 
ball-nose indications at low dynamic pressure [ref. 3]. 

For more than 2 minutes, until the pilot recognized that he had problems, ground control 
encouraged the pilot to operate the aircraft even though it was known that the control system was 
malfunctioning and that much of the displayed information on aircraft states was probably 
erroneous. These actions on the part of the flight controller and the ground control team were a 
causal factor in the accident. 

9,2,2 Contributing Factors 

During the nearly 3 minutes after the electrieal areing from the traversing probe that precipitated 
the events leading to the destruction of the X-15-3, there were several factors that exacerbated 
the causal factors. It is conceivable the pilot might have regained control of the aircraft and 
effected a safe landing had certain of these factors not prevailed at the time. 

One contributing factor was the design that allowed a failure in the AFCS to interfere with the 
pilot’s ability to eontrol the aircraft without any indication to the pilot of the failure other than a 
reliance on the pilot noticing a lack of response to his control inputs. In addition, each time the 
MH-96 adaptive gains were reset to minimums, either via external inputs or as a result of pilot 
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action, there was a delay of several seconds before RCS could be reengaged so as to prevent 
startup transients if the adaptive channels were reset. While this aspeet of the MH-96 design had 
merit for protection of the aerodynamic controls, the designers apparently failed to consider the 
negative impact of the delayed reengagement on controllability when the only control useful to 
the pilot was the RCS. The intermittency of this ineffeetiveness was partieularly insidious 
because, with no other signal of malfunction and the inherently on-off nature of RCS, the pilot’s 
recognition of the failure was obfuseated. 

A seeond contributing factor was the eomplexity of the pilot’s interface to the MH-96. The 
problem of understanding the functioning of the AFCS is exemplified by the following 
instructions in the pilot’s manual: 

If the damper switches are down and the lights are out, power for the system is 
off. If the damper switches are down and the lights are on, the system is 
disengaged but in a state of readiness to be engaged. If the damper switches are 
up (DAMPER position) and the lights are out, the dampers are engaged. If the 
damper switches are up and the lights are on, only the fixed-gain portion of the 
dampers are engaged. 

This type of design is eondueive to human error. The proeedure to switch from RCS control 
through the MH-96 to direet manual eontrol was similarly complex. The pilot’s manual states 
that before the pilot switches to the left side stick for direct access to the RCS he must first turn 
off the MH-96 AFCS. Otherwise, the automated system would oppose the pilot’s commands. 

The pilot would be expeeted to take this action when he recognized that the AFCS has failed. 
When the MH-96 failed on Flight 3-65, the pilot would have had to rely on the aircraft response 
to reeognize that the RCS was not being aetivated by his right side stiek inputs. However, as was 
indicated and noted in the AIB report, the small eontrol inputs required for the experiments and 
the intermittent effectiveness of control made it virtually impossible for the pilot to detect the 
failure. Further, had the pilot recognized that the AFCS was not funetioning properly, it is 
questionable whether he could have identified and taken the necessary steps to disengage it under 
the stressful conditions and the aircraft motions that existed at the time he entered into the spin. 
The proeedure design did not take into aecount the operational context under which the 
proeedure would be used. 

A third contributing factor was the known tendency of the stability augmentation system to 
undergo large-amplitude limit eycle oseillation under some flight eonditions. The possibility of 
this failure mode (having experieneed it on a prior flight) should have resulted in a suspension of 
flight operations using the MH-96 until the design issue was resolved. While the previous failure 
ineidence was of coneem but eaused no damage, in this case it destroyed the aircraft, leading to 
the loss of the pilot. Although this piteh control system instability resulted in the destruction of 
the X-15-3, it is considered a contributing factor because the instability would have been avoided 
if the pilot had disengaged the AFCS when he switched to direct manual control just prior to the 
spin. 
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A fourth contributing factor was in the design of the pilot’s display that used the ADI in two 
different modes (i.e., normal mode and the PAI). Even though this instrument was flown 
successfully on previous X-15-3 flights, it was a fundamentally poor design from a human 
factors perspective. In its normal configuration, the horizontal and vertical needles of the ADI 
indicated a and fi, respectively. When the ADI was switehed to the PAI mode, the horizontal 
needle indieated the pitch angle, and the vertical needle indicated the roll angle. Using such a 
critical display in two different configurations without a clear and salient mode indication is 
conducive to mode confusion, especially when the pilot is under stress and high workload. The 
switch position was the only indication of the PAI mode. 

A fifth contributing factor was that, during the time period and the altitudes at which most of the 
eritieal events oecurred, information displayed eame from the IFDS eomputer. The only other 
source, the ball nose, was known to be unreliable at these flight conditions. There was no 
provision for baekup source of reliable information for the pilot at high altitude in case of failure 
of the IFDS computer. 

When the dynamic pressure became less than about 50 psf, the normal procedure for the pilot 
was to push a switch on the display panel that changed the source of data for the a and fi from the 
aerodynamic source of the ball nose to the IFDS computer. During Flight 3-65, the dynamic 
pressure fell below 50 psf at about 155,000 feet altitude at 10:31:35 PST (MET + 87 seconds), 
by which time the IFDS computer had failed and the computer and instrument malfunction light 
had illuminated. Although the pilot did not make a verbal report, the post-accident examination 
of the cockpit film shows that after hesitating at the switeh for several seconds he pushed the 
data-source switch as planned, despite the IFDS eomputer malfunction light. After switehing the 
source, the fi indication was correctly indicating off-scale nose-right, but the a information was 
erroneous. During Flight 3-65, the dynamic pressure did not increase above 50 psf until after the 
pilot reported he was in a spin. The cockpit film indicates that he never switched baek to the 
aerodynamically driven source of aireraft data and may not have been able to switch once the 
aireraft entered into a spin. 

Finally, the evidenee in the AIB report was reviewed to ascertain what actions taken or not taken 
by the pilot during the eritieal 3 minutes may have been contributing factors in the X-15-3 
accident. 

It was not until 2 minutes after the access to the RCS through the right side stick had become 
intermittent that the pilot realized the aircraft was not responding to his inputs and switched to 
the left side stiek eontrol. Coincidentally, the eontrols worked when called upon during the 
wing-rock and the computed a/y5-check maneuvers. This coincident response contributed to the 
deception that the controls were operating normally. It was not until the pilot was trying to 
maintain control for the precision attitude -tracking task that access to the RCS through the AFCS 
from his right side stick was determined to not be working. The delay in the pilot’s ability to 
recognize the failure contributed to the accident. 


NESC Request No.: TI-14-00957 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

14-00957 

Version: 

1.0 

Title: 

A Comprehensive Analysis of the X-15 
Flight 3-65 Accident 

Page #: 

56 of 107 


The pilot failed to eorreet the error in yaw when he switched to direct RCS control through the 
left side stick. The AIB report attributes this failure to the pilot’s misinterpretation of the PAI 
after he earlier selected that mode for the ADI. However, the AIB report states: 

Since it did not require excessive control inputs to keep the needle close to center, 
the pilot may not have realized his error until it was too late or he may never have 
realized his error, in that he could not or did not recognize any problem with his 
attitude control. 

It is important the AIB recognized the pilot might not have been able to discern the aircraft had 
reached a large yaw error until he discovered that he had no control. The pilot’s failure to 
correct the yaw error, or his inability to detect it, contributed to the accident. 

The evidence suggests the pilot forgot he was in the PAI mode when he switched to the left-hand 
stick RCS control. However, at the moment he switched control, he was performing the 
precision attitude-tracking task (Figure 9.2-1) and he continued to try to complete that task after 
he switched hands. It is difficult to believe that the pilot would have forgotten that he was in the 
PAI mode while he was in the process of performing the very maneuver for which the PAI mode 
was specifically designed. 

The evidence indicates that the pilot did not disengage the MH-96 AFCS when he switched to 
the left side stick control. This was an important failure because the subsequent instability could 
have been avoided had the pilot had remembered to disengage the AFCS when he switched to 
direct manual control, and recovery from the dive might have been possible. While this action 
was practiced as part of the captive carry AFCS equipment checkout procedure, it does not 
appear on the Flight 3-65 radio transcript and may have been skipped to save time [ref 3]. 

The pilot’s apparently impaired performance might be explained by the high stress and workload 
at the moment that he switched controls. By the time the pilot realized he had no control using 
the right side stick and changed to direct manual RCS control through the left side stick, he must 
have recognized that the aircraft had attained large attitude angles and angular velocities, the 
computer and instrument malfunction lights were on, and the displayed information was suspect. 
The pilot may have found himself trying to cope with an uncontrollable aircraft and questionable 
information just as he was starting into the critical descent phase. The aircraft was at an altitude 
at which the aerodynamic controls were ineffective and the AFCS was behaving erratically. 
Coping with these multiple problems could have demanded all of the pilot’s attention, possibly 
causing him to forget actions he had taken (e.g., switching the ADI mode to PAI) or should have 
taken (e.g., disengaging the AFCS). 
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Figure 9.2-1. Time History of Precision Attitude Tracking Task at Peak Aititude [ref. 3] 


9,2,3 Alternative Hypotheses 

The hypotheses appearing in this section are recognized as speculative and lack conclusive 
evidence but are provided since they cannot be discounted as possible contributing factors in the 
Flight 3-65 accident. 


9,2,3, 1 Hypoxia 

A hypothesis considered by the AIB was that the pilot was hypoxic due to an unknown 
equipment malfunction [ref 3]. The X-15 cabin was sealed, pressurized, and thermally regulated 
using gaseous nitrogen derived from the aircraft’s liquid nitrogen supply. The cabin temperature 
was maintained at a maximum of approximately 80 degrees Fahrenheit, and the cockpit and 
instrumentation bays were insulated to minimize heat transfer into the cockpit during high 
aerothermal loading conditions. A cabin pressure differential of 3.5 psi with respect to ambient 
pressure was maintained by the cabin pressure regulator. 
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By 1967, X-15 pilots wore a custom-fitted A/P22S-2 pressure suit containing anti-g bladders. 

The suit pressure and cockpit pressure were equalized, and breathing oxygen was supplied only 
to the face area by partitioning the helmet with a face seal. This design was primarily to mitigate 
the risk of fire associated with an oxygen-based cockpit pressurization system. Oxygen was 
supplied by self-contained seat-mounted bottles with a regulator that forced oxygen into the 
helmet at a differential pressure higher than the suit pressure, ensuring that normal breathing 
would not allow the pilot to inhale pressurization nitrogen. It was known that rapid deep 
inhalations could exceed the differential pressure maintained by the oxygen regulator and result 
in transient inhalation of nitrogen, and that pilots’ respiration rates increased precipitously during 
the boost phase [refs. 4 and 40]. 

It is possible that the pilot may have been experiencing hypoxia due to some equipment 
malfunction (e.g., a failure leading to low differential pressure) and that the situation may have 
been exacerbated during the boost phase as a result of rapid or deep breathing and increased 
stress. Limited testing was performed on the oxygen system components that survived the 
impact, and while the AIB concluded that those components had no direct evidence of failure, 
the pilot’s lactate levels were 10 percent higher than the threshold considered indicative of 
hypoxia at that time. However, results were inconclusive since several hours had elapsed before 
the laboratory analysis could be conducted [ref 3]. 

9,2,3,2 Spatial Disorientation 

A speculation of the AIB was the pilot’s susceptibility to Type-II spatial disorientation (SD), 
which the AIB report refers to as “vertigo,” was a contributing factor in this accident. Despite 
the pilot’s and other X-15 pilots’ self-reported sensitivity to the somatogravic illusion during the 
boost phase, there is no direct evidence that the pilot’s performance was affected by SD during 
the boost phase and performance of the maneuvers, nor was there evidence that he was 
misinterpreting the PAI during these two experiments. 

However, at the moment the pilot switched to direct manual control, he had just come “over the 
top” at about 266,000 feet and had been in a 0-g condition since the end of the engine bum. 
Under these circumstances, the pilot’s susceptibility to SD may have contributed to his forgetting 
to switch off the AFCS, especially as it seems he was still focused on completing the precision 
attitude -tracking task. As the AIB report states, “Vertigo [SD] could have coupled with the 
added workload of sorting the various malfunctions,” and perhaps caused his lack of recognition 
of the yaw attitude if he did in fact misinterpret the ADI in its PAI mode during his subsequent 
actions. Most of the pilot’s experience in the X-15 aircraft was with a normal ADI (i.e., with the 
vertical needle indicating yaw) when he used the left side stick for the RCS. When he switched 
to manual control, he was under stress and high workload, and it is a common human tendency 
under such conditions to revert to the basics in which one is most highly trained. Thus, the pilot 
may have mentally reverted to the normal ADI mode when he switched to manual control. 

It is also possible the pilot was confused as to what to believe in the displays. Pilots are trained 
that the only way to overcome SD is to fly basic instmments and disregard the attitudes 
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suspected by their physical senses. The pilot had been taught that the ball nose did not provide 
reliable information at dynamic pressures less than about 50 psf. He knew he had switched to 
the IFDS computer as the source of data to his displays when the panel display light indicated 
that he should do so, and he knew that the IFDS computer and instrument malfunction lights 
were on. However, the assurances from ground control and the instructions to perform 
experiments that relied on the IFDS computed data may have contributed to the confusion. 

The AIB report states: 

The pilot seemed unaware of a gross heading deviation in spite of three separate 
correctly reading instruments... He apparently was concentrating on a single 
instrument, the vertical needle of the ADI, as a pilot might do if he were trying to 
overcome vertigo [SDJ. 

When some instruments are displaying erroneous information, it is difficult to determine which 
instruments are correct and which are not. When the pilot is focused on a specific instrument for 
the sake of the particular maneuver to be performed, other instruments receive lower priority. 
With the added effect of the flight controller’s assurance the aircraft was “on heading,” the 
heading deviation may have gone unnoticed. Furthermore, tunneled attention and disregard for 
other displays, including audible alarms, are known tendencies of humans under high stress and 
workload, regardless of SD. 

9 . 2.33 Egress System 

Post-flight analysis of the aircraft emergency egress (ejection) system revealed the canopy 
jettison mechanism had been actuated at an altitude in excess of 60,000 feet and had operated 
abnormally. A detailed description of the anomalous canopy jettison activation appears in 
reference 3. The AIB noted that while it was contrary to the flight surgeon’s opinion, the 
physical evidence suggested that the pilot may have attempted to activate the ejection system and 
was unable to do so. A contributing factor may have been the pilot’s physical compatibility with 
the seat design: 

One possibility would be that the pilot could have raised the ejection handles far 
enough to fire the M-3 initiator [canopy jettison] but not far enough to fire the 
M-32 initiator [seat] ... If the canopy jettison were the result of pilot action, which 
is contrary to medical opinion, the possibility that Major Adams was unable to 
complete the movement of the ejection handles to the locked position must be 
considered. It was known that Major Adams was large for the seat, and although 
he had successfully passed the egress training, he had some difficulty in moving 
the handles far enough to reach the locked position that must be attained for 
ejection to take place. 

The noted difficulty in actuating the ejection mechanism [ref. 3] may have been amplified 
in a high-stress, time-critical situation. 
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9,2,3,4 Pilot Training and Past Performance 

The pilot was known to be an exceptionally proficient research pilot and had demonstrated his 
performance on a prior flight when a failed propulsion system mandated an emergency landing 
[ref 4], However, while the pilot was adequately qualified for the operation of the X- 15 -3, it is 
undoubtable that the additional complexity of the human-machine interface in the X-15-3 versus 
the other two aircraft contributed to the pilot’s apparent negative transfer that he exhibited under 
a high-workload and high-stress situation. Furthermore, the pilot had not, unlike more 
experienced pilots, been directly involved in the development and test of the experimental flight 
control system. Finally, the majority of the pilot’s flight and training experience was in the 
X-15-1 aircraft with conventional controls and instrumentation panel. Only 20 percent of his 
logged simulator time was flown in the X-15-3 configuration (Table 9.2-1). 


Table 9.2-1. Pilot Flight and Simulator Experience 


Flight Experience 

Simulator Experience 

Flight 

Flight No. 

Airframe 

Date 

Airframe 

Logged Flours 

Fraction 

(percent) 

173 

1-69-116 

56-6670 (#1) 

October 6, 1966 

56-6670 (#1) 

165.2 

~69 

176 

3-57-86 

56-6672 (#3) 

November 29, 
1966 

56-6671 (#2) 

25.5 

~11 

177 

1-70-119 

56-6670 (#1) 

March 22, 1 967 

56-6672 (#3) 

47.5 

~20 

179 

1-71-121 

56-6670 (#1) 

April 28, 1967 


182 

1-72-125 

56-6670 (#1) 

June 15, 1967 

187 

3-62-92 

56-6672 (#3) 

August 25, 1967 

191 

3-65-97 

56-6672 (#3) 

November 15, 
1967 


10.0 Findings, Observations, and NESC Recommendations 

The analysis of the fatal accident of X-15-3 Flight 3-65 has highlighted several recurring themes 
in the complex scenario leading to and during the flight that resulted in the loss of life. As is 
often the case in aerospace vehicle accidents, a confluence of latent failure modes and 
sensitivities was compounded by the unique flight circumstances. It is plausible that had one or 
more of these factors been mitigated prior to the flight, the accident would not have occurred or 
would have resulted in a serious but nonfatal mishap. The major themes contributing to the 
accident were: 

1 . Insufficient focus on characterizing risks associated with subsystem-level interactions. 

2. Continued flight operations in the face of multiple unexplained system anomalies. 

3. Inadequate documentation, communication, and analysis of failure effects. 
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4. Ineffective design for human-machine integration. 

5. Development of a complacent culture surrounding experimental systems and flight test 
operations. 

Specific findings, observations, and NESC recommendations are detailed in the following 

subsections. 

10.1 Findings 

The following findings were identified: 

F-1, The X-15 3-65 accident was precipitated by an electrical failure in an experiment 

package using COTS components that had not been properly qualified for the X-15 flight 
environment. 

• The electrical isolation mechanism for the experiment package (line fuses) did not 
adequately protect the aircraft main power bus. The ensuing electromagnetic 
interference effects caused numerous subsystem failures, interrupted pilot access to 
the RCS, and led to an eventual loss of control. 

F-2, The pilot’s inability to recognize and isolate the subsystem failures and safely regain 

control of the aircraft was largely caused by the lack of adequate display of safety-critical 
information to the pilot and to ground control, lack of communication of the status of the 
aircraft to the pilot, excessive reliance on the autonomy of the pilot, lack of redundant 
pilot information displays, and the flight controller’s decision to continue with the 
mission despite multiple indications that the safety of flight was compromised. 

F-3, A principal cause of the aircraft destruction was a large-amplitude divergent limit cycle 
oscillation in the MH-96 AFCS caused by a latent design error in the structural notch 
filter that did not account for the nonlinear behavior of the X-15 servoactuator under rate 
saturation when coupled with the lightly damped aircraft longitudinal mode at high Mach 
numbers. 

F-4, The high-gain nature of the MH-96 AFCS, in which it would operate at or near the 

critical stability limit, decreased robustness to unmodeled nonlinearities and parametric 
uncertainty and accelerated the onset of the divergent limit cycle oscillation. 

F-5, By the time of its deployment, the MH-96 had undergone multiple modifications to 
compensate for operational factors not accounted for in its initial concept designs that 
reduced its overall performance and robustness below that of its theoretically ideal 
operating characteristics. 

• These factors included the pilot interface, hysteresis effects, structural flexibility, and 
servoelasticity. There is no evidence to suggest that the effects of these modifications 
were verified analytically against the original design models or that design models 
were updated to reflect observed flight behavior. 
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F-6, Loss of control was compounded by pilot actions resulting from some combination of 
mode confusion, attentional tunneling, negative transfer, and possibly hypoxia and SD. 

F-7, A major contributor to the loss of control was a poor human interface design of the 
X-15-3 aircraft, consisting of (1) lack of clear and salient mode indication on flight- 
critical instruments, (2) a complex and counterintuitive interface, and (3) design such that 
the automated flight control system could interrupt access to the pilot’s only control 
effector without notifying the pilot. 

F-8, The successful deployment of an experimental AFCS in an operational mission mode led 
to a dilution of the perceived risks associated with its use and prevented the pilot and 
ground controllers from recognizing and isolating its failure before the destruction of the 
aireraft was inevitable. 

F-9, Failure detection features of the MH-96 AFCS that were designed to improve reliability, 
when exercised outside their intended design envelope, malfunctioned and caused 
degraded performance, which contributed to the loss of control. 

F-10. Of the five major subsystem failures contributing to the accident, three (i.e., the IFDS 
computer failure, the servo transient anomaly, and the MH-96 limit cycle) had shown 
some evidence of failure on previous flights. 

• The program’s decision to continue flight operations without assessing risk and 
identifying the root cause(s) of these anomalies was a causal factor in the 3-65 
accident. 

10.2 Observations 

0-1, The effeetiveness and availability of ground eontrol to assist flight crews in diagnosing 

and troubleshooting subsystem anomalies can be compromised due to operational aspects 
of the flight profile. 

• For example, known flight regimes with poor radio communication can limit ground 
control situational awareness; critical maneuvers and dynamic events that oceur on 
short timescales (e.g., ballistie atmospheric reentry) lend insuffieient time for action. 

0-2, Complete or near-complete reliance on a flight erew to troubleshoot and resolve 
subsystem anomalies in a eomplex experimental system carries excessive risk. 

• This is especially true in single-pilot operation and even more so in flight regimes that 
have extremely demanding, time-critical piloting tasks. 

0-3, Ballistic space planes are more susceptible to eleetrical arcing in high-voltage 

components than aircraft, launch vehicles, or spacecraft due to the extended time spent in 
the critical pd region. 
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0-4, The use of COTS components and subsystems in aerospace vehicle designs is 

accompanied by the risk that an unknown design element of the component or subsystem 
may interact negatively with other subsystems. 

0-5, Actuator nonlinearity, especially rate limiting, continues to play a role in the introduction 
of latent instabilities in flight control systems that become apparent in high-gain modes of 
operation and with large commands. 

• Such high-gain modes may arise due to high pilot gain (e.g., PIO) or high control 
system gain. Such conditions are generally associated with off-nominal scenarios 
involving large or abrupt maneuvers and may not have been fully exercised in 
simulations. 

10.3 NESC Recommendations 

The following NESC recommendations are directed to the Human Exploration and Operations 

Mission Directorate: 

R-1, Minimize the use of high-voltage electronics, and especially AC potentials, to the greatest 
extent possible. (F-1) 

• In particular, systems with peak potentials exceeding lOOV should be scrutinized to 
ensure that the design is not at risk of corona discharge or breakdown. Environmental 
qualification of high-voltage components for the target environment is mandatory and 
should include testing at simulated flight conditions when practicable. Departures 
from the assumptions of the ideal breakdown theory and the implications of violating 
these assumptions should be rigorously assessed. These include, but are not limited 
to, frequency, wave shape, gas composition and temperature, external radiation, 
contamination, and electrode composition. Assessed risk should be used to inform 
the scope of detailed analysis, simulation, and test activities. 

R-2, Qualify all experimental equipment for the target environment, even if it is electrically 
and mechanically isolated from safety-critical systems. (F-1) 

R-3, Rigorously analyze the reliability and efficacy of electrical isolation and grounding 

schemes to ensure malfunctioning equipment cannot cause cascaded electrical failures. 
(F-1) 

R-4, Thoroughly understand the implications of using COTS components in a system. (F-1) 

• System integrators should assess COTS designs in detail and structure vendor 
requirements such that potentially safety-critical design information is not withheld. 

• The risks of accelerated and/or limited flight qualification of COTS components have 
been highlighted in other recent assessments by the NESC [refs. 41-44]. 
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R-5, Explicitly account for saturation and rate limiting behavior to the greatest extent possible 
in flight control system analysis and design. (F-3, F-5) 

• Simulations and, when practical, incremental flight testing must exereise regions 
outside the expected flight envelope, to include specific cases that induce nonlinear 
behavior. 

• The value of nonlinear simulations can be greatly enhanced by companion 
approximation methods for assessing linear and nonlinear system stability, for 
example, describing function analysis. 

R-6. Carefully weigh the benefits and risks of advanced flight control with the cost and 

schedule impacts required to decrease uneertainty in the design models through high- 
fidelity modeling, element testing, or incremental flight testing and post-flight validation. 
(F-3, F-4, F-5, F-8) 

• Adaptive control is most applicable when system dynamics change in a rapid and 
uncertain way and the environment is potentially uncertain and/or unpredictable. 
Adaptive control should be employed when relevant and warranted by fundamental 
limitations in the predictability or measurability of the system to be controlled. 

• In some cases, the use of a conventional flight control algorithm with improved 
design models and/or high-reliability flight instrumentation (e.g., air data systems) 
may provide equivalent performance to an adaptive system and may have behavior 
that is more easily predictable and analytically tractable. 

R-7, Conduct training of research pilots for experimental systems using piloted simulations, 

especially with respect to off-nominal scenarios and emergency situations, in a simulated 
cockpit environment that is functionally identical to that of the flight vehiele so as to 
minimize the likelihood of negative transfer. (F-6) 

R-8. Ensure priority of pilot and ground control in the event of an anomaly be placed on 

restoring the aircraft to a safe state, which may require the immediate cessation of science 
objeetives. (F-2, F-6, F-7) 

R-9, Identify possible subsystem malfunctions prior to flight and categorically assign mission 
rules based upon their relative severity to assist controllers and flight crews in 
recognizing and diagnosing failures. (F-2, F-8, F-9, F-10) 

R-10, Maintain, to the greatest extent possible, adequate telemetry coverage and voice 
eommunication with the flight crew. (F-2, F-6) 
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• Risk assessments should dietate requirements for mission planning that minimize the 
duration of exposure to flight regimes in which access to ground assistance is 
impeded. 

R-11, Enable ground controllers access to all information on the aircraft systems status needed 
to perform their primary responsibility of maintaining safety of operation. (F-2, F-6, 

F-7) 

R-12, Ensure that ground controllers inform flight crews on the state of the aircraft and its 
subsystems. (F-2, F-6, F-7, F-8) 

• Anomalies that may have any significance to the safe operation of the aircraft should 
be immediately reported to the flight crew. 

R-13, Preclude an automated system, the failure of which would compromise the safety and/or 
the operability of the aircraft, from relying on a single source of aircraft or environmental 
data for computation of its automated actions. (F-2, F-9) 

R-14, Immediately notify the pilot of a flight control system failure. (F-2, F-6, F-7, F-9) 

• If manual control is possible, then any failure must not interfere with the pilot’s 
manual and direct aircraft control. 

R-15, Reconcile modifications with the baseline design methodology if the control system is 
altered to improve the behavior of a fielded design. (F-3, F-5, F-8) 

• If the design process is found to be deficient or poorly correlated with flight, then 
these deficiencies should be resolved and properly documented. 

R-16, Design automation to provide for effective dynamic cooperation between the human and 
the nonhuman agents responsible for operating any complex system. (F-2, F-6, F-7, F-8, 
F-9) 

R-17, Ensure the active mode is clearly and saliently indicated, preferably on the relevant 

display itself, to minimize mode confusion if a critical display is used in two different 
configurations. (F-6, F-7) 

R-18, Suspend flight operations to assess risk in the event that unexplained anomalies or 
uncharacterized failure modes occur during flight-testing of safety-critical systems. 

(F-10) 
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11.0 Alternate Viewpoint 

There were no alternate viewpoints identified during the course of this assessment by the NESC 
team or the NRB quorum. 

12.0 Other Deliverables 

No unique hardware, software, or data packages, outside those contained in this report, were 
disseminated to other parties outside this assessment. 

13.0 Lessons Learned 

No applicable lessons learned were identified for entry into the NASA Lessons Learned 
Information System (LLIS) as a result of this assessment. 

14.0 Recommendations for NASA Standards and Specifications 

No recommendations for NASA standards and specifications were identified as a result of this 
assessment. 


15.0 Definition of Terms 


Corrective Actions Changes to design processes, work instructions, workmanship practices, 
training, inspections, tests, procedures, specifications, drawings, tools, 
equipment, facilities, resources, or material that result in preventing, 
minimizing, or limiting the potential for recurrence of a problem. 

binding A relevant factual conclusion and/or issue that is within the assessment 

scope and that the team has rigorously based on data from their 
independent analyses, tests, inspections, and/or reviews of technical 
documentation. 


Lessons Learned Knowledge, understanding, or conclusive insight gained by experience 
that may benefit other current or future NASA programs and projects. 

The experience may be positive, as in a successful test or mission, or 
negative, as in a mishap or failure. 

Observation A noteworthy fact, issue, and/or risk, which may not be directly within the 

assessment scope, but could generate a separate issue or concern if not 
addressed. Alternatively, an observation can be a positive 
acknowledgement of a Center/Program/Project/Organization’s operational 
structure, tools, and/or support provided. 

Problem The subject of the independent technical assessment. 
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The event(s) that occurred, including any condition(s) that existed 
immediately before the undesired outcome, directly resulted in its 
occurrence and, if eliminated or modified, would have prevented the 
undesired outcome. 

A proposed measurable stakeholder action directly supported by specific 
Finding(s) and/or Observation(s) that will correct or mitigate an identified 
issue or risk. 

One of multiple factors (events, conditions, or organizational factors) that 
contributed to or created the proximate cause and subsequent undesired 
outcome and, if eliminated or modified, would have prevented the 
undesired outcome. Typically, multiple root causes contribute to an 
undesired outcome. 

Supporting Narrative A paragraph, or section, in an NESC final report that provides the detailed 
explanation of a succinctly worded finding or observation. For example, 
the logical deduction that led to a finding or observation; descriptions of 
assumptions, exceptions, clarifications, and boundary conditions. Avoid 
squeezing all of this information into a finding or observation 


16.0 

Acronym List 

a 

Angle of Attack 

P 

Sideslip Angle 

AC 

Alternating Current 

ADI 

Attitude Director Indicator 

AFCS 

Adaptive Flight Control System 

AFRC 

Armstrong Flight Research Center 

AIB 

Accident Investigation Board 

APU 

Auxiliary Power Unit 

BCS 

Ballistic Control System 

COTS 

Commercial off the Shelf 

DC 

Direct Current 

DFRC 

Dryden Flight Research Center 

FRC 

Flight Research Center 

GN&C 

Guidance, Navigation, and Control 

HWIF 

Hardware in the Foop 

Hz 

Hertz 

IFDS 

Inertial Flight Data System 

IMU 

Inertial Measurement Unit 

FCO 

Fimit Cycle Oscillation 

MET 

Mission Elapsed Time 


Proximate Cause 


Recommendation 


Root Cause 
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MSEC 

Marshall Spaee Flight Center 

NESC 

NASA Engineering and Safety Center 

PAI 

Preeision Attitude Indicator 

pd 

Pressure and Gap Distanee 

PIO 

Pilot-induced Oseillation 

PST 

Pacific Standard Time 

RAS 

Reaetion Augmentation System 

RCS 

Reaction Control System 

RRA 

Range Reference Atmosphere 

SAS 

Stability Augmentation System 

SD 

Spatial Disorientation 

SES 

Spaee Eauneh System 

USAF 

United States Air Poree 

USN 

United States Navy 

TDT 

Teehnieal Discipline Team 

V 

Volts 
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Appendix A. Analysis of the MH-96 Adaptive Flight Control 

System 

A Analysis of the MH-96 Adaptive Flight Control System 

The MH-96 AFCS was a form of forward gain adaptive control, which is based upon the idea of multiplica- 
tive modulation of the error gain in the inner loop (the ‘‘forward gain”) in order to maximize performance 
and maintain stable operation [1] . As is weU-known in classical control theory, under certain circumstances 
the maximum performance can be achieved when the forward gain is as high as possible. However, in 
all real control systems, the maximum forward gain is limited by the dynamics of the actuators, sensors, 
structural filters, and other parasitic effects such as flexible modes and sloshing propellant. At forward 
gains exceeding the critical value, the system will either exhibit instability (exponential or periodic diver- 
gence) or win enter a limit cycle (due to nonlinear effects). The latter often is manifested in real systems 
where a physical limitation, such as finite actuator power, ultimately bounds the amoimt of energy input 
to the system. 



Figure A.l: Forward gain adaptive control (FGAC) concept 


In all control systems, the existence of stability bounds on feedback gains limit the achievable perfor- 
mance. For fixed-gain or gain-scheduled control systems, the maximum gain is set as high as practicable 
while maintaining some stability margin to ensure that the system remains stable even when parametric 
variations and model imperfections present a system that is slightly different than that for which the con- 
trol system was designed. Ensuring that the system provides acceptable operation under some assumed 
variation in the actual system provides robustness in the control design. 

The challenge for all aerospace vehicle flight control systems is that the actual plant dynamics differ 
from those assumed during the design phase due to hmitations in model fidelity or stochastic variations in 
the environment. Even if models are accurate, the parameters of the system change as a function of flight 
condition in a way that is difficult to predict accurately. Tkke, for example, the control of the second-order 
short period pitch dynamics of an aircraft in a trimmed configuration. The aircraft short-period mode 
has the response 




(A.1) 


where Ms is the control effectiveness coefficient, Ta is the short-period zero, and Wq,? Ca the bare 
airframe natural frequency and damping, respectively [2]. In order to design a fixed-gain or gain- scheduled 
control system for the short period mode, the control effectiveness coefficient Ms must be known to a 
reasonable degree of accuracy; this parameter affects, among other things, the gain margin in the control 
loop. Prudent design practice for fixed-gain or gain-scheduled systems is to maintain at least 6 dB 
(approximately 2:1) margin in the forward gain, such that the system is robust to about a 2:1 variation 
in the actual parameter Ms [3]. 

However, even in the simplest aerodynamics models, the parameter Ms is a function of the flight 
condition, including (linearly) the dynamic pressure q, and (nonlinearly) the Mach number, angles of 
attack and sideslip, and even the control deflection 6 itself: 


Ms = 

•?0 


(A.2) 
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Given a reasonable estimate of Ms, it is generally straightforward to design a robust control system 
so long as the linear gain factor (dynamic pressure) is available online for computation. In the case of the 
X-15, an estimate of dynamic pressure would have to be derived either from inertiaUy navigated velocity or 
an air data system suitable for hypersonic operation (such as the flow direction sensor). Even with current 
technology, both are difficult to mechanize accurately and rehably over a wide range of flight conditions. 
Furthermore, the value of Ms is challenging to predict in flight regimes that are not well-characterized, 
notoriously so at hypersonic velocities. In the case of the X-15, the dynamic pressure alone {q) could 
vary by a factor of more than 10, and the remaining characteristics were low- confidence estimates due to 
essential limitations in aerodynamic theory and test capability. 

The MH-96 AFCS concept implemented a novel approach for adjusting the gain to provide aircraft 
response characteristics that were approximately constant at all flight conditions. The AFCS concept was 
based upon the knowledge that at some critical value of the gain, the system would become marginally 
stable (in a hnear, time-invariant sense) and would develop into a limit cycle oscillation (LCO). The type 
of limit cycle oscillation depends on the frequency response characteristics of the aircraft, control system, 
and servomechanisms. The MH-96 designers recognized that if the control loop was designed such that 
the servo-actuator dynamics were the dominant parasitic mode (the first to become marginally stable), 
the frequency of the LCO would be almost completely invariant with respect to the control authority 
parameter Ms- Once a hmit cycle is estabhshed in the servo, the hmit cycle amphtude is approximately a 
function only of the forward gain. The gain is a function of the unknown parameter M$ and the controlled 
parameter, the feedback gain k^. Thus, by maintaining a prescribed LCO magnitude, the MH-96 was 
able to continually maintain the forward gain near the critical value, tracking the changes in Ms, while 
requiring no external measurements of dynamic pressure or estimates of the control authority. 

The concept of gain modulation in a nonlinear control system was not new at the time of the MH-96 
design, but its method of implementation was quite advanced. Similar systems had been designed and 
successfully tested on other aircraft, including the Lockheed P-94C and the McDonnell F-101. In addition, 
the F-101 was used as a flight test platform for the MH-96 prior to its first test on the X-15. A system 
conceptually similar to the MH-96 was used operationally on the General Dynamics F-111 from 1964 until 
its retirement from foreign military service in 2010 [4]. 

A.l MH-96 Architecture 

The MH-96 design philosophy was motivated by its intended use for high altitude flights. The first was 
to provide fail-safety and some amount of redrmdancy for the flight control system, given that at the 
time, the basehne SAS had already been shown to be required for stable aircraft control at some flight 
conditions. Second, the MH-96 was to automate the selection of the forward loop gain based upon the 
aforementioned hmit cycle concept. Finally, the MH-96 was to provide automatic blending of the reaction 
control system with the aerodynamic surfaces as the dynamic pressure varied during atmospheric exit and 
entry, and allow the use of hold modes for attitudes and airflow angles based on pilot selections. 

The basic inner-loop architecture of the MH-96 is shown below in Figure A.2. The core components 
consist of the SAS pitch-rate feedback loop, which is functionally the same as that in the fixed-gain SAS. 
The inner loop gain is adjusted by a variable gain amplifier having a nonhnear gain characteristic with 
respect to the input of the gain changer integrator. The integrator is driven by the output of a rectifier 
whose output is compared with a set point. Since the rectifier output is approximately proportional to 
the signal power of the servo output in a specified band, the LCO amplitude can be controlled directly 
using this signal as a reference. The system as implemented contained several additional filters that are 
not depicted in Figure A.2. 

The MH-96 was implemented using only analog electronics, and as such the designers were subject to 
hmitations in the range and frequency response of the active and passive electronic components. 
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Figure A.2: MH-96 Pitch Axis Architecture 


A. 1.1 Development History and Design Features 

The X-15 MH-96 AFCS began development in dime 1959 and concluded in December 1962. The design 
concept arose as an evolution of adaptive concepts developed in the late 1950’s, and relied extensively on 
development and flight test experience of a similar system for the F-lOlA aircraft [5], 

The MH-96 was designed primarily with high-altitude mission-critical operation in mind, and was 
engineered with a high level of attention to subsystem reliability and redundancy. The MH-96 system was 
implemented in two independent strings, each having a dedicated rate gyro package, control electronics, 
gain changer hardware, and stick force transducers. The gain changers ran in parallel and the total 
loop gain at the servo input was based upon the sum of both gain changer outputs. Failure monitoring 
electronics were implemented to disable one channel of the MH-96 in the event of a detected anomaly. In 
this case, the other channel was able to provide sufficient gain to maintain acceptable handling qualities 
within a few seconds, since the single channel would increase the gain to compensate for the loss of the 
other channel [1]. 

Servo hardover failures were considered a credible failure mode by the design team, and were mitigated 
via an internal servo monitor associated with each servo. The servo command and response were compared 
to that of an internal analog model, and if the actual servo output rate differed in sign from the modeled 
output rate, the servo was disconnected and hydraulically locked [1]. Finally, a mechanical link from the 
pilot’s center stick (and by interhnk, the side stick) directly to the power actuator valve was provided in 
parallel with the servo input. This provided a mechanical override of the servo behavior, and the servo 
sizing and gearing allowed the pilot to overpower the servo with brute force if it opposed his commands. 
This feature was called upon during early flight tests of the MH-96; multiple pilots incorrectly engaged 
hold modes and mechanically overrode the pitch servo commands in order to maintain angle of attack [6]. 

Failure modes analysis was conducted and redundancy was included, within the hmitations of the 
analog implementation, where it was warranted [7]. As implemented, the system was tolerant to any 
single-subsystem or component failure excepting the power actuator servo, which was not redundant. 
Failure modes were evaluated in the X-15 fixed-base simulation using actual flight control hardware where 
possible [5]. Reliability of the integrated system in the adaptive mode was computed to be greater than 
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99% dialing typical X-15 mission scenarios; the reliability of the fixed-gain subcomponent of the MH-96 
was computed to exceed 99.4% [1]. Since the decision to remove the ventral fin had not yet been made 
at the time of the MH-96 development, the reliability guidelines considered the requirement for stabihty 
augmentation of the otherwise unstable airframe at certain entry conditions. 

The MH-96 system was developed with substantial engineering support from NASA and USAF re- 
search pilots, including active X-15 pilots with flying experience on the other two aircraft. During the 
MH-96 development and beginning in July 1960, flight characterization of prototype flight control hard- 
ware in the MH-96 configuration was conducted using an F-101 that had previously used an earher version 
of the AFCS, the MH-90 [1]. 

RCS control in the MH-96 was provided by a conventional hnear phase-plane design that provided 
rate damping or attitude hold based upon the selected mode. The RCS engage thresholds were originally 
adjusted to provide engage/disengage at relatively high dynamic pressures, but initial flight tests concluded 
that a substantial savings in propellant could be realized through adjustment of the hysteresis thresholds, 
which eventually were set at 90% and 75% of the full-scale adaptive gain for engage and disengage, 
respectively. Extensive assessment of the RCS jet characteristics was conducted in support of the design, 
including the development of jet models based upon test data [7]. 

The transparency of the MH-96 reaction control blending, unfortrmately, was also its most significant 
design flaw. Indication of the state of the reaction controls was not provided to the pilot, and proper 
operation of the RCS could only be deduced from visual observation of the attitude rockets [8]. This 
behavior would come to play a pivotal role in the 3-65 accident. 

Although considered an experimental flight control system up to and including the demise of X-15-3, 
the MH-96 AFCS was qualified for flight operations in a two-tiered flight campaign consisting of “pre- 
acceptance” demonstration flights followed by “acceptance” quahfication flights in 1961-1962. The first 
X-15 flight with the MH-96 activated was on December 20th, 1961. The first seven flights (engineering test 
and evaluation) were conducted by Neil Armstrong (NASA) and Robert White (USAF). The NASA/USAF 
acceptance flights (flights 8-11) were flown by Joe Walker (NASA) and Robert Rushworth (USAF). All 
subsequent flights on this airframe (more than 60) were made with the MH-96 engaged [9]. 

A. 1.2 Knoovn Shortcomings 

During its greater than 6 years in use, the MH-96 demonstrated reliable operation and came to be accepted 
as an “operational” rather than “experimental” component of the X-15-3 aircraft. The evaluation and 
operation of the system was not without anomalies, and many were reproduced on the ground using 
identical hardware. 

Some of the capabihties and engineering features of the MH-96 were later found to be superfluous in 
the X-15 apphcation. In the initial design and flight qualification effort, a substantial focus was placed 
on hold modes, including and angle- of- attack hold mode, a heading hold mode, and a roll attitude hold 
mode. While these modes were designed to alleviate pilot workload and were evaluated in the qualification 
tests, they went unused by the operational pilots for virtually aU subsequent flights. This most certainly 
is an artifact of evaluator pilots’ experience with the hold modes in initial flights, where they tended 
to cause mode confusion and on multiple occasions resulted in pilots manually overpowering the trim 
actuators with the hold mode engaged. In fact, the somewhat famous incident of Neil Armstrong’s Mach 
3 Pahndale overflight was the result of an unintentional skip entry precipitated by a failure to recognize 
that the MH-96 hold mode was interfering with the entry angle- of- attack modulation [10]. 

Some unintentional behaviors were artifacts of limitations in the modeling of the aircraft during 
the MH-96 development, or practical limitations in its application. Most of these were known during 
development or discovered during the initial flight test campaign or in incidences in later flights. 

1. Measoored hysteresis effects in the X-15 control soirface actuators were greater than those initially 
provided to the contractor, lowering the frequency and characteristics of the small amplitude servo 
limit cycle. Higher hysteresis levels also lowered the effective adaptation rate, implying that entries 
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having high dqj dt wo\ild often operate for a brief period at supercritical gains. In most cases, 
this resulted in slightly higher amplitude limit cycles (3 degrees peak-to-peak), but the effects were 
otherwise benign [1]. 

2. RCS jet firings created a larger than expected transient gain reduction as an effect of servo response 
to the attitude rates induced by the RCS. The use of hysteretic engage/ disengage logic was a result 
of this issue [7]. 

3. In quiescent operation (e.g. when powered up on the ground), system hysteresis could prevent the 
formation of the desired fimit cycle and cause gains to ramp to maximum. This was alleviated in 
ground testing through preloading of the control surfaces, and, as predicted, did not occur in flight 
due to turbulence and aerodynamic loads. 

4. Large pilot input commands were known to be sensed by the gain changer and cause transient 
reductions in gain. This is an artifact of this type of control architecture, given that a linear filter 
acting as a frequency-domain discrimination mechanism cannot distinguish between periodic signals 
with high power spectral density in the high-frequency range of interest and transient signals with 
rapid rise times. Limiter circuits were installed to mitigate this effect to some extent. In most 
flights, the transient gain reductions were small and went unnoticed by the pilot. 

5. An unexplained servo transient anomaly persisted on the X-15-3 airframe that appeared unique 
to the MH-96 hardware implementation. The anomaly was manifested as a random servo “kick” 
resulting in a rapid but small amplitude motion of the servo. The direct control effects of the servo 
transients were negligible, but the unexpected transient was detected by the gain changer and caused 
temporary reductions in loop gain on the order of twenty seconds. Its exact cause was never formd, 
but was probably a sensitivity to disturbances on the aircraft power bus [8] . 

6. Both types of failure monitoring circuits caused control system malfunctions due to false-positive 
sensing of failure conditions. The servo rate monitors frequently caused resets in a single channel, 
most likely due to the aforementioned servo transient anomalies. These were usually quickly noticed 
by the pilot and reset upon occurrence. In addition, a gyro rate monitor circuit was provided on 
each channel to detect full-scale gyro output failures by opening the failed channel in the event the 
gyro output exceeded 22.5 degrees per second. Under normal operational conditions, rates of this 
magnitude were not encountered. In the servo reset case, all gains associated with that channel 
were reduced to their minimum values so as to mitigate the risk of supercritical operation if a reset 
occurred at high dynamic pressure. However, if a reset occurred at low dynamic pressure, a several 
second time delay would elapse before the gains returned to sufficient values to enable the RCS. 

7. Pilot display of MH-96 behavior was substantially absent from the initial design. It was improved 
to some extent as the result of initial flight tests, including relocation of the MH-96 status panel 
to be within the pilot’s restrained field of view [10]. In addition to the lack of status information 
regarding the RCS system, the human interface with the ARCS remained markedly complex. 

8. The mechanical interlink between the servoactuators and the control inceptor imphed that adverse 
motion of the control surfaces was directly reflected through the mechanical hnkages into both 
the center and side-stick controllers, sometimes with substantial forces. A severe “stick kick” phe- 
nomenon occurred when the servo overran the power actuator rate capabihty, which were much 
slower than the servos. This was resolved by the introduction of flow restrictors on the servos [9]. 
However, in all cases, servo motion commanded by the flight control system was reflected as stick 
motion. A secondary set of electric trim actuators (foUow-up trim) was commanded to periodically 
recenter the stick [5]. The possibihty of large amplitude and high force feedback motion to the stick 
remained, especially in the presence of large control surface motions involving the servos. 


NESC Request No.: TI-14-00957 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

14-00957 

Version: 

1.0 

Title: 

A Comprehensive Analysis of the X-15 
Flight 3-65 Accident 

Page #: 

77 of 107 


9. A divergent limit cycle existed in the MH-96 configuration pitch and roll axes as a result of a 
structural mode filter added just prior to MH-96 acceptance testing in 1961. This mode of failure 
was known to the program, definitely by 1965 (having occurred in another flight, although non- 
destructively), and possibly as early as 1962 (predicted by simulation). However, the exact reasons 
for this behavior may have been unknown until determined through the analysis associated with the 
present report. 

A. 2 MH-96 X-15 Model Development 

An extensive effort was undertaken to construct an sufficiently detailed simulation of the X-15 flight 
control system so that both nominal and off-nominal behaviors that were believed to have contributed to 
the Flight 3-65 accident could be reproduced. As much of the X-15 design details are dispersed among 
multiple sources, constructing a model that is a reasonably accurate representation of X-15-3 at the time 
of the accident proved to be a substantial challenge. Some data was extracted from internal and publicly 
available research reports, but the vast majority of the configuration data associated with the flight control 
system was taken from the MH-96 contractor reports [7, 1, 11, 12, 10, 6, 5]. It is worth noting that these 
reports axe not self-consistent and one must very cautiously interpret the data therein to ensure that the 
quoted information is representative of the final aircraft configuration after the “acceptance flight test” 
period in 1962. 

The simulation was constructed in the M ATLAB /Simulink environment so as to support both time- 
domain nonlinear simulation (for reproduction of limit cycle behavior) and frequency-domain describing 
function analysis (for prediction and forensic analysis of adverse nonlinear behaviors). 

The objective of the X-15 simulation is to reproduce and analyze the behavior exhibited in the 3-65 
accident. To that end, detailed environmental, navigation, and aircraft dynamics models are not required, 
since the dominant nordinear effects appear in the servo, power actuator, and flight control elements. In 
the present simulation, the majority of the high-fidelity modeling is associated with the actuator and the 
MH-96 electronics. 

A summary of the major simulation elements and their data sources appears in the following subsec- 
tions. 


A. 2.1 Airframe Dynamics 


For the purposes of the present control system analysis, a linear, time-invariant model of the short period 
pitch mode of the X-15 is sufficient to capture the rigid-body and aerodynamic effects on the control 
system. Since structural flexibility was not a key factor in the control system instability (having been 
sufficiently attenuated via filtering), structural modes were not included in the analysis. In addition, the 
normal acceleration (JV^) feedback channel of the MH-96 was not modeled as the expected characteristics 
appear using only the attitude dynamics. 

Normalizing Eq. A.l by dynamic pressure, the short-period airframe rate dynamics have the general 
form 


G,{s) 


QO 


Mso[s + ^ 


' + 2Ca‘^a + 


(A.3) 


where Mgo, <^a-> and are functions of Mach number and dynamic pressure and qo is the reference 
dynamic pressure (taken as unity, ® = 1). The simulated flight condition is that of the LCO onset at 
approximately 270 s MET, q = 390psf and Mach 4.7 with a moderate angle of attack of a fa 5° (see 
Appendix B). 

Flight data appearing in [13] was collected during the test program at various Mach numbers and 
angles of attack through free-decay fits. Data for the SAS-oft (bare airframe) cases was used to estimate 
the natural frequency and damping ratio of the vehicle pitch mode as a function of Mach number in the 


NESC Request No.: TI-14-00957 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

14-00957 

Version: 

1.0 

Title: 

A Comprehensive Analysis of the X-15 
Flight 3-65 Accident 

Page #: 

78 of 107 


moderate angle- of- attack range. Based on interpolation to the aforementioned flight condition, it follows 
that u>a. = 2.56 rad/sec (0.41 Hz) and Ca = 0-08 at this flight condition. Natural short period damping of 
the X- 15 pitch mode was quite low. 


X-15 Short-Period Pitch Mode (TN D-2532) 



Figure A.3: X-15 shorhperiod pitch data (bare airframe). 

The control effectiveness parameter Mjo is determined from the power-off pitch moment data in [13] 
at the empty loading condition (Table 1). 


Parameter 

Description 

Value 

S 

wing area 

200.0 ft^ 

C 

wing reference chord 

10.27 ft 

hy 

pitch axis MOl, empty 

8.7 X 10^ slug — ft^ 

(^mSh 

stabilator effectiveness 

-0.7448 ^ 

Mso 

control parameter {cSCmSh/ ^yy) 

-0.0176 


Thble 1: Power-off pitch moment data 


The pitch zero is estimated from [12] at Tcj = 1.64. 

The shorbperiod dynamics are mechanized in a state-space form and incorporated into a simple 
airframe model including the rate gyro dynamics (Figure A. 4). 

The rate gyro response is second order with parameters Un = 125 rad/sec and C = 0.4 [5]. A surface 
turbulence model is included with a break frequency of 1.0 rad/sec. 

The dynamic pressure is variable and scheduled with respect to time. For simulation of the actual 
3-65 entry, it is assumed that the Mach number and angle of attack (and thus the short-period mode 
parameters) are constant while the dynamic pressure is varied. The dynamic pressure profile for the entry 
is extracted from the as-flown flight data ranging from about 190 to 285 sec MET (referenced to ignition) 
(Figure A. 5). For analysis of the limit cycle behavior, the dynamic pressure is fixed at the value where 
LCO began to appear in the flight data at approximately 270 sec MET, or ^ = 390 psf 
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Figure A. 4: X-15 short-period dynamics with sensor 




Figure A.5: X-15 3-65 entry dynamic presstrre and MH-96 LCO 
A. 2. 2 Servoactuator Model 

The X-15 servoactuator is the dominant nonhneax element in the aircraft rate loop. The X-15 actuator 
was a two-stage power-assist design driven by a series hydraulic servo and hydraulic power actuator. The 
design of the servo for the MH-96 changed from a fully-integrating configuration to a semi-integrating 
configuration during the development of the MH-96 in order to improve low-frequency phase margin 
characteristics while still maintaining integrating trim capabihty [6]. In NASA FRC pubfications, the 
servo travel is given in units of inches (±1), corresponding to ±15 degrees of stabilator authority (out of 
30 degrees total). The mechanical pilot interface to the power actuator provided another ±15 degrees of 
authority for the pilot [14]. The layout of the servoactuator system is shown in Figure A.6. 
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Figure A. 6: X-15-3 servoactuator system 

In the present simulation, a prescribed motion model the surface dynamics is used. Since the cantilever 
stabilator resonant mode was above 12 Hz [5], both the rigid-body and elastic motion of the stabilators 
is neglected. The servoactuator parameters are taken from Refs, [14, 7, 12, 5] and are shown in Thble 2. 
Several critical servo loop gains are missing from the reports, especially [5], and were empirically adjusted 
to match other frequency response data (appearing as transfer functions or frequency response magnitude 
plots) or were calculated from equivalent circuit parameters (e,g. degree surface per unit fJ-A). 


Parameter 

Value 

Subsystem 

Model 

Servo input gain 

1,0 

Servovalve 


Servo rate limit 

4.0 in/sec 

Servo travel limit 

1.0 inch 

Servo/power actuator backlash 

0.25 deg 

Servocy Under 

R77+I)' ^ - 0-006 

Power actuator mechanical gain 

15 deg/inch 

Power actuator / surface backlash 

0.25 deg 

Surface flow gain 

25.0 /sec 

Servo lead network 

r, = 1.2, T2 = 0.2 

Surface rate limit 

25.0 deg/sec 

Surface position limit (absolute) 

±30 deg 


Table 2: X-15 servoactuator model parameters 


The complexity of this full nonlinear model of the actuator can be compared with the commonly used 
approximation appearing in much of the X- 15 literature; 


Ha(s) 


1 

0.15s -t- 1' 


(A.4) 
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A.2.3 MH-06 Model 

The MH-96 autopilot model of the pitch axis is developed primarily using the information in Refs. [7, 1, 
12, 15, 5] and is shown in Figure A. 7. 


dock 



Figure A.7 : MH-96 SAS loop model 


The MH-96 consists of the SAS inner rate loop and the attitude hold loop. For the purposes of this 
study, the attitude hold loop is disabled as it was not activated on flight 3-65. The inner rate loop contains 
two filters; one is in the feedback (minor loop) configuration and the other is in the compensator (forward 
loop) configuration. In the present form, the MH-96 AFCS and X-15-{1,2} SAS are functionally identical 
if the MH-96 adaptation dynamics are disabled (fixed gain) and the “Lead Network 1” and “Lead Network 
2” filters are modified accordingly. 

In the MH-96 configuration, the pitch axis input filter (reference model) is given by a first-order lag 
of the form 

Hm(s) = (A.5) 

0.5s -11 ^ ' 

and the “Lead Network 1” filter is a lead-lag stage having the transfer function 




1 

0.01s -1 1 


/ 0.1s -1 1 \ 

\ 0.01s -11/ ■ 


(A.6) 


The “Lead Network 2” filter is a structural notch filter of order 9. The notch filter design appearing in 
the original design report [12] is compared with the magnitude and phase response of the reconstructed 
filter (Figures A.8 and A. 9). 
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i'lgureia. Fraquency Response. Final Motc-h Filler ConUgui stion 


Figijre A.8: Original notch filter 


MH-96 ARCS Notch Filler 



Figure A.9: Reconstructed notch filter 

In the design configuration prior to the 1960-1961 modifications to attenuate the stabilator resonant 
modes, the form of the “Lead Network 1” and “Lead Network 2” filters differed and their original form 
can be found in [5] . They are given by 



0.12s -F 1 

(A. 7) 

0.02s -F 1 
0.2s -F 1 



Hl2{s) = 

(A.8) 

0.02s -F 1' 


It is important to note that while the fixed-gain and MH-96 inner loop designs are functionally nearly 
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identical, the aggressive notch filter is required in the MH-96 configuration to attenuate the high-frequency 
gain of the loop shaping filter (Equation (A.6)). The high gain characteristic of this lead network is 
necessary in the adaptive configuration to ensure that the desired hmit cycle (“adaptive mode”) appears 
at the specified frequency. 

The MH-96 adaptation law (Figure A.IO) consists of the servo LCO detector circuit, comprised of 
a high-pass filter, input limiter, and band-pass filter-rectifier. The rectified output is compared with a 
setpoint limit cycle amplitude (assumed to be on the order of the hysteresis magnitude, approximately 
0.1 deg average power). The input hmiter is set to a value of three times the hysteresis magnitude [5]. 



Figure A.IO: MH-96 adaptation law 

The adaptation gain scale of the MH-96 was nonhnear, having an exponential gain characteristic [1]. 
Furthermore, the down-gain is a factor two larger than the up-gain [16], which was set such that at the 
saturated input condition, the gain would reach full scale in approximately 20 seconds. Based upon the 
data in [5], the nonlinear gain function is approximated by 

where u is the gain changer integrator output and ko is the minimum gain. The minimum and maximum 
gains of the fixed-gain SAS and the MH-96 differed, and are given in Thble 3. 



5A5 [Ul 

MH-96 IS] 

Minimum (deg/(deg/sec)) 

0.075 

0.546 

Maximum (deg/(deg/sec)) 

0.750 

11.645 


Table 3: SAS and MH-96 gain range 


The band-pass and high-pass filters are described by the appropriate continuous-time transfer functions 
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given by 


Hbp{s) 

Hhf{s) 


4.883s2 

0.01405s^ + 0.6725s3 + 12.24s^ + 132s + 877.9’ 
0.0521s 

0.0002558s 2 + 0.052s + 1’ 


(A.10) 

(A.11) 


respectively. In both cases the filter coefficients have been normalized to a maximum singular value of 
unity to avoid implementation of intermediate analog amplifier gains in the MH-96 model. The band pass 
filter is a mechanization of the original filter appearing in [5] with the center frequency adjusted to the 
expected post-flight-test servo limit cycle frequency of approximately 2. 0-2. 5 Hz. 


A. 3 Time-Domedn Simulation 

The MH-96/X-15 model was evaluated under nominal and off-nominal conditions to verify the implemen- 
tation and characterize the sensitivity to inputs and flight condition. The individual simulation cases 
follow. 


A. 3.1 Nominal Adaptation Behavior 

The nominal adaptation test case is designed to evaluate the gain changer behavior. The aircraft dynamics 
are held in a fixed-parameter configuration at a Mach number of 4.7 and a dynamic pressure of 400 psf. 
The gain cycling behavior consistent with the hterature [17] is shown in Figure A.ll. In this case the 
servo LCO frequency appears at the expected 3. 5-4.0 Hz. The cycling behavior appears only in quiescent 
conditions and is substantially more pronounced with the original filter design. The modified (flight) 
design, consistent with the data found in [15], exhibits better steady-state convergence and lowers the 
servo LCO frequency to approximately 2 Hz (Figure A. 12). In both cases, the resultant motion at the 
surface is on the order of 0.5 degree peak. As noted in the original design documentation, the attainable 
limit cycle frequency and amphtude depends strongly on the hysteresis and deadbanding in the actuator 
linkages. 


MH-96 (pre-FT) servo LCO. M=4.7, 400 psf 
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Figure A. 11: Gain cychng (pre-flight-test configuration) 
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Figure A.12: Gain cycling (flight configuration) 


The efficacy of the invarianhresponse design of the MH-96 can be illustrated using a transient response 
simulation of a pitch maneuver (Figure A. 13). In this case, the attitude loop is closed {kp = 0.7) and a 
5 degree pitch attitude command is issued with a period of 10 seconds at a dynamic pressure of 400 psf 
and 800 psf. The MH-96 provides an aircraft transient response that is invariant with respect to the 2:1 
variation in dynamic pressure, and tracks the reference model filter 1st order lag characteristic. 


MH-96 Invariant Response. 5 deg pitch pulse, T=10 s 



time (sec) 

Figure A. 13: MH-96 invariant model response 


A. 3. 2 Entry Adaptation 

The high dynamic pressure and dynamic pressure rate seen during the 3-65 anomalous reentry was within 
the design capability of the MH-96 adaptation gain dynamic range and adaptation rate so long as no 
exogenous disturbances caused saturation of the control surface actuators. This can be verified through 
simulation of the adaptation dynamics during the planned 3-65 entry (to approximately 800 psf) and the 
anomalous entry (exceeding 1500 psf). In both cases, since the system is operating in a balhstic mode 
prior to the entry, the adaptive gain is at maximum. Even when using the accident flight dynamic pressure 


NESC Request No.: TI-14-00957 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

14-00957 

Version: 

1.0 

Title: 

A Comprehensive Analysis of the X-15 
Flight 3-65 Accident 

Page #: 

86 of 107 


profile, the adaptive law is successful in establishing the desired servoactuator limit cycle and modulating 
the forward gain to the proper value (Figure A, 14). This analysis result contradicts the author’s early 
hypothesis that the adverse LCO was precipitated by a dynamic pressure rate-of-change exceeding the 
capability of the MH-96 gain changer. 



Figure A.14: MH-96 3-65 entry, no disturbances 


A. 3. 3 Adverse LCO 

The adverse LCO appears in the anomalous entry due to saturation of the control surface actuators such 
that the short-period pitch mode of the aircraft is simultaneously excited during the period when the 
gain adaptation would otherwise be rapidly reducing system gain to compensate for the rapid increase in 
dynamic pressure (Figure A.15). 



time (sec) lime (sec) 

Figure A.15: MH-96 3-65 entry, pilot input 

In this case, the actuator saturation is induced using a pilot stick pulse equivalent to 8 degrees of 
surface deflection with a 1 second period. The rapid pulse induces a combined response of the rigid-body 
short period dynamics that maintains actuator saturation. The MH-96 gain changer, no longer able to 
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identify and establish the desired small- amplitude LCO, maintains maximum gain [8], In this high-gain 
condition, the short-period pitch mode is divergent. 

The same divergent LCO can be induced in the ^stem even in a fixed gain condition v/ith fixed 
dynamic pressure, if the pilot input magnitude is large enough to induce rate limiting in the actuator 
(Figure A. 16). This occurs with moderate gain levels exceeding those of the fixed-gain SAS but much 
below the MH-96 maximum gain. This implies that a more serious mechanism involving the fundamental 
stability of the SAS inner loop is responsible for the hmit cycle behavior, since in the fixed-gain case the 
behavior persists. 


S<-15 3-65-97 LCO onset, M=4 7, 12 deg surtace, 1 sec pulse 
q=390 psi (lixed), adaptation oft 
5 20 | 1 ^ . , 
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X-1 5 3-65-97 LCO onset, M=4.7. 12 deg surtace, 1 sec pulse 
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Figure A. 16: Fixed dynamic pressure, large pilot input, fixed gain 


It is illustrative to consider that the introduction of lag due to the implementation of the structural 
notch filter may be related to the apparent rate-hmit divergent limit cycle oscillation. Under the time- 
varying 3-65 entry conditions, the system is simulated with an identical pilot input but with the original 
loop filter design (Eq. A.7). Although rate limiting is induced for a short time, the actuator does not 
couple with the short-period mode and thus no divergent oscillation is induced (Figure A. 17). 

y 

« 3-65-97 (original filler), M=4.7. 8 deg surtace, 1 sec pulse _ 3-65-97 (original filler), M=4.7, 8 deg surtace, 1 sec pulse 

20 
0 

-20 

0 20 40 60 80 100 



Figure A. 17: 3-65 entry, large pilot input, original filter 
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Prom these results, it can be concluded that the structural notch filter introduced to mitigate the 
stabihator resonance destabihzes the inner loop independently of the adaptive gain mechanism, while the 
original design did not. An analytical investigation using numerical describing function analysis confirms 
this and appears in the following section. 

A. 4 Describing Function Analysis 

Describing function (DP) analysis is a useful tool for predicting the existence of sustained periodic solutions 
of SISO nonlinear feedback dynamical systems [18]. The use of describing functions is based on several 
approximating assumptions, the most prevalent being that the response of a nonlinear dynamical system 
with output q and sinusoidal input u = A sintot described by 

z = f(z,u) (A.12) 

q = h(z,u) (A. 13) 

can be approximated by a complex-valued describing function N(A,u>) as a function of the input amphtude 
A and the input frequency ui. If the nonlinearity in Equations (A. 12- A. 13) is incorporated into the feedback 
path of an otherwise linear SISO plant, under certain conditions the describing function N can be used 
to approximate the nonhnear element for the purposes of analysis (Pigure A. 18). 


r(i) 


rit) 



Pigure A. 18: Original and describing function approximation of feedback nonlinearity 


In most introductory texts on describing function analysis, it is assumed that the nonlinearity is single- 
valued and static (memoryless), in which case / = 0 and q = fe(u.); that is, the system has no dynamics. 
However, the theory does not preclude the use of a dynamic nonhnearity in the feedback path so long as 
the describing function is computable (e.g., the nonlinear system is locally stable with respect to bounded 
inputs), even if it cannot be determined analytically. 

When the approximation N is incorporated into the loop, the linear Nyquist theorem predicts the 
existence of a sustained periodic oscillation (a hmit cycle) at a particular frequency uj, and amplitude Aj 
if the hnearized system return difference function satisfies the equality 


1 + G(ju})N(A,jui) = 0, 


(A.14) 


for some lj = LJk aJid A 
relationship 


Aj. This leads to the well-known sinusoidal inverse describing function 


G(juj) = 


1 

N{A,ju!) 


(A.15) 
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The sinusoidal describing function N is computed from the truncation of a Fourier series expansion 
of the response of the nonlinearity to an input sinusoid. The complex number N has magnitude 


\N\ 


A 


and angle 


ZJV = tan ^ 



where a [ , are the real Fourier coefficients associated with the first harmonic, given by 


h[ 



(A.16) 


(A.17) 


(A.18) 

(A.19) 


A. 4.1 X-15 Analysis Overview 

In the X-15 analysis, it is reasonably assumed that for the purposes of Unfit cycle prediction, the adaptive 
gain itself does not introduce dynamics (that is, the adaptation mode is separated in frequency from the 
limit cycle dynamics) and that the plant (airframe, filters, etc.) are Unear. 

The present form of DF analysis used herein for the prediction of the MH-96 limit cycle behavior is 
similar to the exact numerical describing function technique described by Klyde et al. [19] but is extended 
to faciUtate direct analysis of the effect of the DF in-the-loop owing to the multivariable nature of the 
adaptive gain, DF frequency, and loop amplitude. 'IfaditionaUy, inverse describing function analysis de- 
termines a frequency w = and ampUtude A = Aj at which Equation (A.15) is satisfied by determining, 
graphically, intersections of G(jtj) and —N{A,itj')~^ in the complex plane for which oj = ui' , since each 
are an independent function of frequency. In the present analysis, the function G{ioS)N{A,jtJ) (Equation 
A.14 ) is computed over a set of discrete frequencies w = Wfc, fc = 1,2, . . . ,n and compared with the point 
— 1 -I- jO in the complex plane. This provides an equivalent criterion to Equation (A.15) but eliminates 
the additional frequency variable. At each unique ampUtude Aj, the resultant curve can be interpreted 
similarly to a traditional Nichols or Nyquist plot, and provides a measme of equivalent (nonUnear) gain 
or phase margin with respect to the predicted LCO. This will be referred to as “DF-in-the-loop.” 

The nonlinear element rmder analysis is the servoactuator assembly, including the servovalve, servo- 
cyUnder, and power actuator. At each discrete amplitude Aj, a frequency vector is constructed such that 
the describing function N = N(Aj,jojjc) is computed over a discrete set of frequency points k = 1,2, . . .n 
with 0.06 < wj; < 125 rad/ sec (approximately 0.01 - 25 Hz). For each j and k, the response of the servoac- 
tuator (degrees response with respect to degrees command) is computed numerically from a time-domain 
nonUnear simulation of the servoactuator element using Equations (A.16- A.19) above. In aU cases, the 
time-domain simulation is allowed to reach steady state to avoid corruption of the Fourier coefficients by 
transient effects. 

Finally, the numerical describing function N{Aj,joj^\) is used directly to compute the forward transfer 
function G{jui[k])N{Aj , jcj[k]) after conversion of the Unear part to discrete time. A Umit cycle core exist 
at some value of the forward loop gain if the curve G{jLJic) N{Aj , crosses the —n phase Une at any 
point and that point is within the gain authority of the adaptive law. 

In this analysis, parametric uncertainty is not considered; these results assrune a perfect implemen- 
tation of the flight control electronics and X-15 parameters based upon a single test point. Limit cycle 
behavior, therefore, is more likely to occur in the actual system due to unmodeled dispersions. 
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A. 4. 2 Analysis of Small- Amplitude MH-96 LCO 

The DP technique can be used to predict the small- amplitude servoactuator LCO at the converged value of 
the forward loop gain. Prom the flight configuration example shown above in Section A.3.1, the adaptive 
gain reaches a steady-state value of 5.7 deg/ (deg/sec) at a dynamic pressure of 390 psf yielding a smaU- 
amplitude limit cycle of 2.58 degrees (taken at the servo input) and approximately 0.5 degrees at the 
surface with an LCO frequency of 1.6 Hz. 

A DP approximation of the servoactuator with these parameters is computed and compared with the 
nominal linear model of the servoactuator. As can be seen in Figure A. 19, the response of the actuator 
matches well at low frequencies but exhibits slightly more phase lag. 


X-1 5 Servo -f Power Actuator Describing Function 




Figure A. 19: X-15 servoactuator smaU-amplitude describing function 

Note that in this analysis, the other actuator nonlinearities in addition to the basic rate limiting 
contribute to the diverent behavior. However, a describing function analysis of the power actuator alone 
confirms that the response matches well with the published results in the existing literature [20] (Figure 
A.20). 
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Figure A.20: Describing function analysis of X-15 power actuator only, 15 degree input amplitude 

Using the servoactuator DF in-the-loop at the stated forward gain condition, the smaU-amphtude LCO 
is accurately predicted by the numerical analysis. Since the forward gain in the DF analysis matches the 
converged gain, the system intercepts the critical point. The — tt phase hne is shown for comparison. 
It should be noted that the short period mode, appearing at approximately 0.4 Hz, has relatively little 
equivalent phase margin at this condition at stable values of the forward gain. 


X-1 5-3 open loop with nonlinear actuator 
M=4.7. q = 390 psf, a=2.6deg 



Figure A.21: X-15 servoactuator small-amplitude LCO prediction 
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A. 4. 3 Analysis of Large- Amplitude MH-90 LCO 

Based upon the time-domain analysis, it was observed that the large-amplitude LCO tended to be pre- 
cipitated by large inputs causing actuator rate saturation coupled with an excitation of the short-period 
pitch mode. In order to determine the possible transition amphtude for the adverse LCO, the amplitude- 
frequency parameter space was searched for a DF such that the short-period mode would approach critical 
stability when at the 3-65 entry conditions (maximum forward gain, 390 psf). The transition amplitude 
for this condition consists of a large servo command of approximately 80 degrees peak equivalent, or a 
command-to-authority factor of about 6:1. Large servo commands exceeding the servocyUnder limit of 1 
inch (15 degrees equivalent) will cause saturation in the servo, the power actuator, or both. The effects of 
saturation on the actuator frequency response are shown in Figure A.22. Near the short-period frequency, 
the effective phase lag is increased by approximately 25 degrees. 



Freaiiencv iHzi 


Figure A.22: X-15 servoactuator large-ampUtude describing function 

The coupled response with the servoactuator DF in-the-loop is shown in Figure . At a transition 
amplitude, the shorhperiod mode phase margin approaches zero, predicting a periodic oscillation in the 
closed loop near a frequency of 0.55 Hz (simulation shows a frequency consistent with the short-period 
mode at 0.43 Hz). While not as accurate a predictor of the oscillation frequency as in the low-amphtude 
case, this is to be expected using the approximation technique since the dominant complex poles near this 
frequency are clearly associated with the short-period mode. 

It was noted before in the analysis of the high-frequency desired LCO that the short-period mode had 
very httle phase margin when operating at the critical gain (Figure A. 21). In the design of the MH-96, 
an implicit assumption was that the system phase shaping (via filters in the rate feedback path) provided 
for a linear phase margin that was approximately invariant with respect to the forward gain. Based on a 
comparison of the original system response with the flight configuration using the structural notch filter, 
it appears that the introduction of the notch filter substantially degraded the phasing of the short period 
mode due to the introduction of additional low-frequency lag (Figure A.23). Even under these conditions, 
the original design maintains more than 30 degrees of phase margin for the short-period mode. 
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X-1 5-3 open loop with nonlinear actuator, original filters 
M=4 7, q = 390 pst. a=81 .9 deg 


X-15-3 open loop with nonlinear actuator, flight filters 
M=4.7.q = 390 psi, a=81.9 deg 



Figure A.23: X-15 servoactuator large-amplitude LCO prediction 

Under the proper circumstances (including a flight condition where the bare airframe damping is small 
combined with a saturated servoactuator), the effective system lag was sufficient to destabilize the rigid 
body. This appears to have been a latent flaw in the design of the notch filter, whereas the original 
system design was not susceptible. However, the original filters did not provide sufficient attenuation 
for the problematic stabilator resonant modes, and lacking a detailed design study, it is unclear as to 
whether cny design would have been feasible given the limitations in the analog filter implementation. 
Furthermore, while describing function techniques and the “equivalent lag” effects of saturated actuators 
were known at the time, it cannot be reasonably expected that the designers would have been able 
to analyze the robustness of the system in the level of detail presented herein due to limitations in 
computational resources. 

A. 5 Conclusions 

The MH-96 adaptive flight control system was an exceptional example of practical and innovative flight 
control system engineering that substantially improved the capability of the X-15-3 airplane. Unfortu- 
nately, the realities of its implementation appear to have eventually so constrained the design that its 
robustness was substantially and tmknowingly compromised, and alack of attention to the htiman- machine 
interface substantially contributed to the loss of X-15 Flight 3-65. 
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Appendix B. Reconstructed Flight Data 

Flight data from X-15 Flight 3-65 appearing in this appendix were reeonstrueted from a 
photocopy of the original strip chart recordings (see Figure B-1) appearing in the 1968 AIB 
report [ref 3]. As can be expected with data of poor quality, it is subject to some uncertainty and 
contains a number of filtering artifacts. It is, however, the best available representation of the 
aircraft states known to the authors. 

Where data are lacking or incomplete in the original report, the data were reconstructed based on 
assumed atmospheric properties. Unfortunately, the trajectory parameters appearing in the report 
do not indicate which range reference atmosphere (RRA) was used for the reconstruction or the 
sources for the vehicle’s Earth-relative velocity magnitude (composite range radar estimates are 
assumed). As a result, Mach number and dynamic pressure (q) are estimated from other vehicle 
states assuming a quiescent 1976 Standard Atmosphere model. 



Figure B-1. Example of Original Strip Chart Recording 

Data were time correlated by cross reference to key events appearing in Appendix K of 
reference 3 combined with a re-timing analysis of the digitized cockpit film. To generate plots 
(Figures B-2 through B-6), data were extracted from the original graphics via image processing, 
then interpolated and uniformly sampled at 10 Hz. The data were noise filtered with a zero- 
phase (forward-backward) second-order low pass fdter ifc= I Hz, ^ = 0.707). MET is referenced 
to ignition occurring at 10:30:08 PST on November 15, 1967. 
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Figure B-5. Flight 3-65 Attitude Angles (Earth relative, LjJ =0 true North; 

magnetic variation 1 6° E) 
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Figure B-6. Flight 3-65 Earth-relative Velocity Magnitude and Dynamic Pressure 
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The X-15-3 aircraft carried three 16-mm film cameras, one of which was attached to the inside 
of the pilot canopy (Figure B-7) and took photographs of the right side of the pilot panel at a rate 
of 2.5 frames per second [ref 3]. 



Figure B-7. Location of Film Camera on Canopy (DFRC) 


Extracted frames from the cockpit film are shown in Figures B-8 through B-17. Critical events 
and pilot actions are identified in these events based on the re-timing analysis. A digitized 
version of the original film was found as a 29.97-fps digital video disc in the public domain. The 
frame timing from the 2.5-fps film to the 29.97-fps digital was not uniform, so the timing 
synchronization was based on observable events in the video assuming a uniform frame 
rate. This appears to yield a synchronization that is accurate to approximately +/-0.25 sec. 

The first synchronization event is the rise in chamber pressure at engine ignition (approximately 
1 second post release), which can be seen in the pilot's chamber pressure gauge at the top left of 
the engine instrumentation panel below the IFDS vertical tapes. According to the AIB report, 
this event occurs at 10:30:08.5 PST. The last event is the last film camera frame prior to sun 
exposure, which occurs at 10:34:54.4 PST. Based on this information, a total time span between 
these events of 4:45.9 is expected, and the frame timing was adjusted to achieve this. 

Timecode information was added indicating the frame count (not correlated with the original 
film frame count, which is unknown), and the mission elapsed time referenced to ignition time. 
The recovered video starts about 12 seconds prior to ignition. 

The synchronization is relatively accurate. The pilot can be seen to activate the PAI switch at 
MET + 84.7 seconds, corresponding to 10:31:33.2 PST. The AIB reports this event at 
10:31:33.0. 
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Figure B-8. Cockpit Film - Ignition Indicated by Increasing Chamber Pressure (MET = 0 seconds, 

10:30:08 PST) 



Figure B-9. Cockpit Film - Boost Phase (MET = 41 seconds, 10:30:49 PST) 
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PAI mode on 


Figure B-11. Cockpit Film - Pilot Engages PAI (MET = 84 seconds, 10:31:32 PST) 
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Figure B-12. Cockpit Film - Pilot Attempts IFDS Reset (MET = 87 seconds, 10:31:35 PST) 



Figure B-13. Cockpit Film - Pilot Selects Computed IFDS Aerodynamic Angles <50 psf 

(MET = 126 seconds, 10:32:14 PST) 
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Figure B-14. Cockpit Film - One of At Least Two MH-96 Disengages (MET = 139 seconds, 

10:32:27 PST) 
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Figure B-1 6. Cockpit Film - Spin Entry (MET = 202 seconds, 1 0:33:30 PST) 


in PAI mode 


Sun angle 
indicates yaw rate 



ADI in PAI mode 


Figure B-1 7. Cockpit Film - Last Camera Frame (MET = 286 seconds, 1 0:34:54 PST) 
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